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EXECUTIVE SUMMARY 


This Fly-By-Light ( FBL) Augmentation Plan Is specifically Intended to 
facilitate the Introduction and certification of U.S. built 
Fiy_By-W1 re/Fly-By-Llght ( FBW/FBL) commercial transport aircraft, a 
significant U.S. aircraft Industry Issue. While the applications of this 
program are ostenslvely for aircraft, the technologies and approaches 
resulting from It will benefit a broad crossectlon of U.S. Industry. 

The proliferation of critical digital fly-by-wire aircraft systems has 
evidenced a number of new potentially catastrophic failure modes not 
encountered with conventional mechanical and analog control systems. The most 
dramatic news to hit the EMC (electromagnetic compatibility) community In some 
time Is the recent revelation that a number of flight critical fly-by-wire 
systems are highly susceptible to radiated electromagnetic energy. Despite 
this, the performance and weight requirements Imposed on military aircraft 
have necessitated the use of fly-by-wire flight and engine controls. The 
problem of designing highly reliable, maintainable, and lightweight 
fly-by-wire flight controls Is further complicated by such factors as: 

o The Increasing complexity (hardware and software) and number of aircraft 
digital systems yields new types of failure modes; 

o The Increasing use of composites for aircraft skins decreases the first 
line of shielding provided by their metal counterparts; 

o The worsening EM (electromagnetic) environment due to the proliferation 
of radar, microwave, television, and radio sources, as well as the 
Introduction of directed energy weapons; 

o New high speed Integrated circuits require less power to change state (or 
be upset) . 

The extensive application of FBL technology for data transfer and sensing 
functions can substantially reduce the electromagnetic susceptibility of 
critical digital flight control systems. Since fiber optics are virtually 
Immune to electromagnetic Interference (EMI) the need for special shielding Is 
eliminated and the number of conductive paths Into the digital electronics Is 
substantially reduced. Extensively shielding a critical digital flight 
control system Is costly, heavy, and difficult to maintain. The use of fiber 
optics will reduce system weight and shielding maintenance. 

In general, fly-by-1 Ight refers to a wide range of complementary technologies, 
concepts, design approaches, and computer based tools needed for next 
generation flight critical digital flight control systems (FCS). While fiber 
optics are a major part of FBL, many other aspects need to be evaluated, 
Integrated, and balanced to optimize these FCSs. 


Ill 
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1.0 INTRODUCTION 

1.1 Background 

This report discusses the driving factors and developments which 
make fly-by-llght viable. It also provides documentation, 
analyses, and recommendations on the major Issues pertinent to 
facilitating the U.S. Implementation of commercial FBI aircraft 
before the turn of the century. To accomplish this goal a unified 
national effort Is required. This plan would be coordinated by 
the National Aeronautics and Space Administration (NASA) and would 
Involve both government and Industry participation. 

In this report "FBL" Is used In a general sense, referring to a 
wide range of complementary technologies, concepts, design 
approaches, and computer based tools needed for next generation 
flight critical digital flight control systems (FCS). While fiber 
optics are a major part of FBL, many other aspects need to be 
evaluated, Integrated, and balanced to optimize these FCSs. 

It should be noted that continuous Involvement of Federal Aviation 
Administration ( FAA) engineers Is essential In both planning and 
executing the proposed FBL Program. 

The Introduction of f ly-by-wlre/f ly-by-llght technology Into 
U.S. manufactured commercial transport aircraft places 
unprecedented demands upon airframe companies, equipment 
suppliers, and regulatory agencies. These demands necessitate a 
high degree of cooperation between all parties Involved. 

Areas of particular concern Include: 

o Ultra-reliable computing (hardware/software) 

o EME 

o Verification and Validation 
o Optical techniques 
o Life-cycle maintenance 
o Basis and procedures for certification 

1.2 Ultra-reliable computing 

Ultra-reliable computing (l.e., extremely fault tolerant 
systems) Is an area that has received significant Research and 
Development ( R&D) emphasis In past years. This work Includes 
concepts such as "zero unscheduled maintenance" and "extended 
availability". 
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1.3 Electromagnetic Effects 

Protection/quantification relative to the effects of the 
electromagnetic environment (EME) Is a design problem coupled to 
environmental conditions that has received Inadequate attention In 
the past but now has been elevated to prominence. Such a late 
recognition of the magnitude of this problem has left Industry 
with major near term design and Verification & Validation related 
problems to solve. Figure 1.3-1 Illustrates the levels of 
electrical/electronic systems for which EME must be addressed. 

1.4 Optical Techniques 

Optical techniques show potential to resolve significant aspects 
of the EME problem mentioned previously. Size and weight savings 
are also expected. It Is anticipated that optical networking and 
data links will be applied to first generation U.S. commercial 
FBW/FBL aircraft. Subsequent generations will likely make 
extensive use of optical sensing technologies. 

1.5 Verification and Validation 

Verification, Validation, and Certification (VVC) must also come 
to the forefront. It Is generally agreed by equipment suppliers 
now developing FBW/FBL systems that state-of-the-art VVC 
methodologies are Inadequate. Of particular Interest Is the role 
of modeling the system response to faults (functional and gate 
level) In VVC as commercial FBW/FBL Is Introduced. The work 
already done at NASA-LARC (l.e., HARP, CARE III, SURE, GGLOSS) 
must be expanded and matured. Software verification and aspects 
of certification are also areas of concern that must continue to 
be emphasized. 

1.6 Life-Cycle Maintenance 

Life-cycle maintenance Issues become safety Issues when 
considering commercial FBW/FBL. It Is anticipated that 
requirements for flight line maintenance must be sharply reduced. 
This can only be achieved through new design methodologies which 
facilitate Increased system effective mean-tlme-between- 
unscheduled-removal s (MTBUR) through the application of "secondary 
redundancy" techniques. Redundant elements are Included and can 
fall without the need for removal of the line replaceable 
unit (LRU). Accordingly mean-tlme-between-fal lure (MTBF) 
decreases while MTBUR Is sharply Increased. That Is, additional 
system redundancy Is Included not for safety but for "extended 
system availability." This means that a number of simple faults 
can be accumulated and tolerated In redundant elements of a system 
for an extended period of time without Impacting system safety. 

The net result Is less unscheduled box removals for minor and 
oftentimes elusive squaks. 
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1.7 Basis and Procedures for Certification 

One of the major goals of this program Is to provide guidance to 
the FAA In the development of certification criteria. Generally, 
noncrltlcal avionic systems for commercial transport aircraft have 
been designed to various Federal Aviation Regulations (FARs) such 
as FAR 25.1309. However, rules or guidance materials are not 
available for designing flight critical systems using 
FBL technology. Therefore, It Is Important that the FAA be 
Involved throughout this technology verification program. 

In order to accomplish this, FAA certification specialists will be 
directly Involved In the development of advanced technologies. 

This Involvement will assist the FAA In the development of the 
certification criteria outside of the typical adversarial 
relationship between the FAA and Industry In an actual 
certification project. 

With the FAA establishing the FBL/FBW certification criteria 
early, the typical uncertainty of certification for the airframe 
manufacturers will be eliminated. This uncertainty comes from 
advanced designs not meeting the exact requirements that would be 
contained In a special condition that does not exist at the 
beginning of the design process. Since these systems are normally 
developed for new airplanes, this uncertainty has In the past 
forced the airframe manufacturer Into parallel development of a 
conventional system for the new aircraft model, thus protecting 
themselves against the possibility that the new system would not 
be developed. This practice has proved to be costly In time and 
money to the manufacturer, the FAA, and the customer. 
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Aircraft Level 

Environment induces electric and mag- 
netic fields (charge and currents) and in- 
jects lightning currents on aircraft exterior 

Wide bandwidth: DC-40GHz 

Transient and CW 

Understanding of coupling mechanisms 
and the corresponding analytic models/ 
algorithms needs further development 

i Test methodologies need further devel- 
opment and validation 

> Aircraft level testing needs justification 
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Control System Level 

• External energy penetrates to interior via 
aperatures, composites, seams, joints, 
and antennas 

• Voltages and currents induced on flight 
control system components and cables 

• Coupling mechanisms relatively well 
understood 

• Analytic models/algorithms need further 
development 

• Test methodologies need further devel- 
opment and validation 
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Electrical/Electronic Equipment 
and Card Level 

• Voltage, fields, currents and charge on 
components penetrate into box interiors 
via holes, seams, and cables 

• Energy (voltage and current) picked up 
by wires and printed conductors on 
cards and carried to electronic devices 

• Coupling mechanisms relatively well 
understood 

• Analytic models/algorithms need further 
development 

• When applicable, test methodologies 
need development and validation 
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Device Level 

• Card and device conductors carry energy 
to the semiconductor chips 

• Possible effects 
— Damage 

— Upset 

• Coupling mechanisms relatively well 
understood 

• Analytic models/algorithms need further 
development 

• Device response characteristics and 
models/algorithms need further 
development 

• When applicable, test methodologies 
need development and validation 
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2.0 REQUIREMENTS FOR FLY-BY-LIGHT FLIGHT CONTROL SYSTEMS 

2.1 Background 

Douglas Aircraft Company (DAC) studies conducted In early 1984 
showed that a transport aircraft fly-by-wire (FBW) flight control 
system (FCS) would provide significant benefits In terms of 
Increased performance, weight reduction, and cost effective 
manufacture, and operation. These studies also Indicated that a 
transport FBW system could be designed for high reliability, 
maintainability, and fault survivability. Furthermore, If 
properly designed, no mechanical backup would be required and 
dlspatchablllty would not be jeopardized. 

Military helicopters and fighter aircraft have employed FBW flight 
and engine controls for years, but the higher reliability, 
maintainability, and safety requirements of transport aircraft 
have precluded the use of FBW technologies until recently. Recent 
demands for Increased performance and operational capabilities of 
transport aircraft have encouraged the development of FBW flight 
controls. 

The Airbus A320, Introduced In 1987, has full authority digital 
FBW In the pitch and roll axis, partial FBW In the yaw axis, 
partial mechanical In the yaw axis, and a mechanical horizontal 
stabilizer. The rudder and the mechanical trim stabilizer 
controls provide minimal mechanical backup for flight control 
following a complete failure of the primary FBW system, with the 
goal of maintaining flight until the primary system can be 
reactivated or until landing. 

2.2 Safety Requirements 

Safety Requirements for a full time, flight critical commercial 
aircraft f ly-by-wlre/f ly-by-llght ( FBW/FBL) system with no 
mechanical backup exceed the requirements asserted for any 
previous commercial system In the area of probability of loss of 
function. The probability of loss-of-alrcraft demanded by the 
Federal Aviation Administration (FAA) Is 10 9 fllght/hour. 

Loss-of-alrcraft can result for a variety of reasons; Including 
FBW/FBL system failure, various structural failure modes, and 
certain propulsion related failures. The Issue of concern here Is 
the FBW/FBL system. 

(Note that the A320 has a rudimentary mechanical backup system but 
It Is not given any credit In probability of loss of function 
calculations . ) 
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2.3 System Electromagnetic Environment (EME) Effects Protection 

System EME effects protection Is required and must receive 
elevated emphasis In this program. Recent alleged EME-related 
aircraft losses have revealed a major problem that will likely get 
worse. Accordingly, the EME effects problem has gone from 
relative obscurity to perhaps the pacing problem relative to the 
Introduction of U.S. built FBW/FBL commercial aircraft. Both 
design and verification and validation (V&V) requirements will 
require emphasis. Recent trends In the EME threat are depicted In 
Figure 2.3-1 . 

2.4 Fiber Optics 

2.4.1 Optical Data Bus 

Optical busses, particularly for avionics and primary flight 
controls, are of great Interest for first generation FBL 
aircraft. The avionics bus, which links the aircraft's main 
flight boxes, must provide bidirectional communication between all 
(32 to 50) terminals. The primary flight control bus must provide 
bidirectional communication between one flight control computer In 
each of 9 to 24 smart actuator terminals; communication between 
actuators Is not required. 

In order to achieve fiber optic data bus flight readiness, 
protocol and architecture requirements must be established for 
each bus application, component technologies (e.g., connector 
type, fiber composition, size, etc.) must be evaluated and 
certified, and Installation and maintenance procedures must be 
developed . 

2.4.2 Optical Sensors 

Optical sensors will be required to be as accurate, reliable and 
maintainable as the devices which they replace. An evaluation of 
various sensor technologies Is needed to determine their 
applicability to flight critical avionics. 

2.5 System Functionality 

The system functionality requirements for a first generation 
U.S. built FBW/FBL system are anticipated to resemble those of the 
A320 . That Is, In normal operation, both Inertial data and air 
data would be fully utilized and full envelope protection would be 
provided. Autoland capability would not be considered part of the 
FBW/FBL computer's function. However, the Impact of Its Inclusion 
should be studied. A sldestlck Interface should be assumed. 
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FIGURE 2.3-1 


EME Threat Trends 


4782S 


2-3 


Fly-By-Light 

Technology Development Plan 


FINAL REPORT 
30 August 1990 


2.5.1 FBW/FBL Computer to Sldestlck Interface 

The sldestlck to flight control computer Interface requires study 
and requirement development. These requirements would address 
Captain/First Officer sldestlck coupling, reliability requirements 
for sldestlck design, sldestlck to FBW/FBL Interface, and 
sldestlck ergonomics. Other areas of study would Include 
alternatives to sldestlcks and the pllot/sldestlck Interface. 

2.5.2 FBW/FBL Computer to Actuator Interface 

The FBW/FBL computer to actuator Interface Is an area of 
particular Importance If a "smart" (l.e., computer controlled) 
actuator Is assumed. A smart actuator allows a digital bus 
Interface media and local monitoring of actuator operation with 
attendant advantages. However, this could open up the possibility 
of simultaneous loss of all actuators of a given type due to a 
"generic" fault. To help enhance safety, a concept under study by 
Douglas Aircraft Company and Honeywell, Inc. (DAC/HI) Is referred 
to as a smart "actuator override" In which the FBW/FBL computer 
would be capable of bypassing all computerized Internal actuator 
monitoring functions to either force the actuator to engage or 
force the actuator to disengage. It Is believed that such a 
capability should be required. The flight control computer has 
access to aircraft sensor data, comprehensive monitoring, and 
degradation strategies. 

2.6 System Availability 

System availability for a FBW/FBL system without mechanical backup 
becomes a safety Issue. It has been argued that routine flight 
line maintenance of FBW/FBL computer systems should not be 
permitted. Rather, repairs should be restricted to dedicated 
repair facilities. It can be argued that the mean-tlme-between- 
fallure ( MTBF ) of the FBW/FBL computers should be at least as good 
as the equipment they replace. The above Issues lead to 
requirements such as "no unscheduled maintenance" or possibly 
"deferred maintenance". To preclude to a high probability the 
necessity of unscheduled maintenance requires redundant elements 
within the computers with an associated reconfiguration capability. 

Such redundancy Is therefore not directly safety related and 
accordingly has come to be called "secondary redundancy". This 
secondary redundancy may be required because It Is anticipated 
that a FBW/FBL computer assembly might require a mean-tlme- 
between-unschedu led- removal (MTBUR) approaching 100,000 hours; 
thus achieving zero unscheduled maintenance. 
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2.7 Graceful Degradation 

Graceful degradation In the context of FBW/FBL systems refers to 
control law reconfiguration In flight after the loss of a sensor 
set being used to control flight. The system must be capable of 
gracefully and automatically transitioning from fully augmented 
flight to levels of lesser augmentation and to stlck-to-surface 
operation or even activation of a backup system. Pilot override 
of this feature should be provided. 

2.8 Generic Fault Tolerance 

Design provisions must permit the system to remain operational In 
the presence of generic faults. Areas of concern Include 
hardware, software generation, and system specification. Relative 
to these fault classes, N-verslon techniques are now widely used 
In the commercial aircraft Industry (l.e., DAC, BCAC, British 
Aerospace [BAe], Airbus). It should be noted that although 
generally regarded as effective In relation to certain specific 
fault classes, N-verslon techniques lack both an established set 
of design rules and a clear quantification of benefits. 

It Is widely agreed that a major area of problems and potential 
safety hazards relates to the specification Itself. Specific 
requirements for V&V of system specifications must be developed. 

2.9 System Recovery from Upset (Soft Fault Tolerance) 

Automatic system recovery from upset must be addressed. It Is now 
becoming Increasingly clear that most system faults are 
Intermittent, rather than permanent hardware failures. However, 
little attention has been given to this area. Upsets can result 
from many causes, not the least of which Is EME. DAC/HI are 
actively working on techniques which will permit the system to 
operate through a disturbance via a methodology referred to as 
"Transparent Recovery". Note that we are not talking about 
eventual reinstatement of a failed FBW/FBL computer but rather 
designing FBW/FBL computers which can tolerate the disturbance 
with no external effect (l.e., "transparent"). 

2.10 Backup Systems 

Backup flight control will likely be Included In a first 
generation FBW/FBL systems. An electrical Implementation (as 
opposed to mechanical) Is assumed. No safety credit should be 
taken for this backup during certification. The backup can be 
single-thread (l.e., no primary redundancy). It would take 
control automatically In the event of complete loss of the primary 
system. Note that It can be argued that no means need to be 
provided to permit the airline pilot to activate the backup. This 
entire Issue warrants further study. 


4782S 


2-5 




Fly-By-Light 

Technology Development Plan 


FINAL REPORT 
30 August 1990 


3.0 TECHNOLOGY ASSESSMENT 

3.1 Background 

The proliferation of flight critical digital flight control 
systems (FCSs) has evidenced a number of new potentially 
catastrophic failure modes not encountered with conventional 
mechanical and analog control systems. Recent evidence has 
Indicated that flight critical fly-by-wire (FBW) systems are 
highly susceptible to radiated electromagnetic (EM) energy. 

The extensive application of fiber optic technology for data 
transfer and sensing functions will substantially reduce the EM 
susceptibility of flight critical digital FCS. Since fiber optics 
are virtually Immune to electromagnetic Interference (EMI) the 
need for special shielding Is eliminated and the number of 
conducted paths Into the digital electronics Is substantially 
reduced. Extensively shielding a critical digital FCS Is costly, 
heavy, and difficult to maintain. The use of fiber optics will 
reduce system weight and shielding maintenance. 

3.2 Safety Requirements 

3.2.1 General Issues 

Relative to the Internal workings of commercial transport 
f ly_by-w1 re/fly-by- light ( FBW/FBL) systems, extensive 
Investigations of ways to guarantee availability of 10 _y /hour or 
better have been pursued. Still there remain unanswered questions 
as noted In Section 2. Specific to the FBW/FBL flight control 
computer system Internal operation questions not fully resolved 
Include the following: 

A. Quantification of benefits gained from software development 
methodologies (e.g., N-verslon). 

B. The effects of long term field maintenance on safety level 
degradations . 

C. The benefits and risks associated with design for "extended 
availability" through secondary redundancy. 

0. Validation of system fault tolerance/redundancy management 
methodologies with new and proposed system fault effects 
modeling methodologies. 

3.2.2 Generic Fault Concerns 

Several approaches to protection from "generic" faults have been 
suggested. These Include: 

o N-verslon software and/or hardware 

o Performance assessment monitor 
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3.2.2 Generic Fault Concerns (Continued) 

o Proof of correctness 

A review of articles documenting numerous N-verslon software 
experiments, results In no clear quantification of benefits. 
Further, It appears likely, even to the casual observer, that the 
specific type of Implementation methodology adopted will heavily 
Impact the effectiveness of this technique. The following two 
needs relate to our understanding, first of N-verslon 
effectiveness experienced In Industry, and secondly of the 
Implementation methodologies that have been adopted. 

A. Survey and document Industry experience with the application 
of N-verslon techniques. 

B. Based upon experience gained In both Industrial applications 
and research experiments, one or more development 
methodologies should be documented. It Is essential that 
formal, mature methodologies be established. 

3. 2. 2.1 N-verslon Techniques 

Currently N-verslon techniques are being applied to numerous 
critical commercial aircraft FCS. Examples Include: 

o MD-11 

o 737-300 

o B777 (currently In development) 
o BAe-1 46-300 (currently In development) 
o A310 
o A320 

3. 2. 2. 2 Performance Assessment Monitors 

This technique defines specific monitor functions to detect event 
system behavior. This technique has been applied by Honeywell and 
others In both commercial and military avionics. To date the 
benefits and limitations of this technique have not been 
thoroughly explored. 

3. 2. 2. 3 Proof of Correctness 

Methodologies to rigorously provide the validity of a 
specification have been suggested In the literature. The 
applicability of such techniques has. In general, been viewed 
negatively. However, no documented study has been conducted to 
date. 
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3.3 System Electromagnetic Environment Protection 

3.3.1 Introduction 

Electromagnetic environments produce electrical energy of the same 
type that Is used by electrical/electronic equipment to process 
and transfer Information. As such, this environment represents a 
fundamental threat to the proper operation of systems that depend 
on such equipment. For systems providing flight critical 
functions that depend upon Information processed by electronic 
equipment, the electromagnetic threat to systems translates to a 
threat to the airplane Itself. Specifically, the EM environment 
Is a top level system Issue that must be conscientiously accounted 
for In any airplane design where control Is provided by a 
FBW system architecture. Although the substantial coupling paths 
resulting from wiring running throughout the aircraft fuselage Is 
eliminated by a FBL data link architecture, the primary means of 
processing Information Is still electronic, and the 
electromagnetic environment (EME) Is still a significant threat* 

In general the EM environment elements of Interest for aircraft 
Include the following: 

A. Lightning 

B. High Intensity Radio Frequency (HIRF) 

C. Electrostatic Discharge (ESD) 

D. Intrasystem EMI 

E. P-statlc 

F. Special Military Requirements 

1. Electromagnetic Pulse (EMP) 

2. High Power Microwave (HPM) 

For commercial aircraft, the emphasis should be on lightning and 
HERF, because most of the energy and system hazards arise from 
these threats. Their Interaction with aircraft systems is global 
and also the most complex, requiring more effort to understand. 
ESD Is of Interest from an operational viewpoint, but Is 
especially of concern In the development of latent defects, which 
are usually controlled during manufacture and assembly stages. 

EMI Is an Intrasystem problem which Is locally controlled, but 
still requires sound knowledge and practice. P-statlc Is also 
usually controlled by rather well known design practices. 
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3.3.1 Introduction (Continued) 

Therefore, for this effort It Is assumed that the lightning and 
HIRF environments are those of concern. The other environments 
may be of occasional Interest, but do not drive this technology 
development. 

In addition to the fundamental trend of relying on electronic 
equipment for flight critical functions, another trend that has 
Increased the concern about EME Is the Increased percentage of 
composite materials In aircraft construction. Because of their 
decreased conductivity, composite materials result In less 
Inherent shielding by the aircraft structure. 

3.3.2 EME Threat 

Lightning and HIRF are two extraordinarily severe EME threats to 
the overall aircraft. Of the two, lightning produces the most 
Intense EME. The lightning-produced environment Is relatively 
Instantaneous (exists for less than 0.5 msec for each lightning 
stroke occurrence). During a lightning strike (one lightning 
strike or flash can contain several Individual strokes), 
relatively large currents flow In the wing structure, fuselage, or 
empennage, which In-turn Induce relatively large voltages and 
currents In the aircraft wiring. Such voltages and currents 
appear at equipment Interface circuits. In an all metal aircraft, 
Induced voltages are usually less than 200 V although 1000 V or 
more have been projected for some aircraft wiring when excited by 
the EM environment of a severe stroke. For aircraft employing the 
extensive use of composite materials, the lightning-produced 
voltages and currents could Increase substantially. Whether they 
do or not depends upon the shielding measures provided In the 
aircraft. 

In addition to the large currents associated with return strokes, 
high rates of rise short duration pulses (noise pulse) have been 
found to occur randomly throughout a lightning flash. Interspersed 
with the other current components. The current amplitude of such 
pulses are much less than those of a return stroke (first or 
subsequent) and while not likely to cause physical damage to the 
aircraft or electronic components, the random and repetitive 
nature of these pulses may cause Interference or upset to certain 
systems. As previously noted, a typical cloud-to-ground lightning 
flash contains more than one restrike. In fact, flashes 
containing up to 24 strokes randomly spaced have been recorded. 

For evaluation of Indirect effects (damage and upset) It Is 
necessary to consider the multiple-stroke nature of an actual 
lightning flash, because the succession of strokes may Induce 
corresponding pulses In data transfer circuits (for example) 
causing cumulative damage (In some special Interface circuit 
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3.3.2 EME Threat (Continued) 

configurations) or upset to sensitive systems or devices. 

Figure 3.3-1 shows the wave shape of two natural lightning events 
and Figure 3.3-2 shows the waveshape of engineering waveforms that 
reproduce Important lightning waveform parameters (amplitude, rise 
time, action Integral). Figure 3.3-3 shows severe engineering 
representations of the environments associated with a multiple 
stroke and bursts of noise pulses. 

Even though lightning produces the most Intense EM levels, the 
radio frequency (RF) environment dramatically exposes 
electrical/electronic system susceptibility to the effects 
(Induced voltages and currents) of EME. This discovery of system 
susceptibility was probably made possible because the RF 
environment Is deterministic (not Instantaneous, random, and 
capricious as Is the case for lightning), and therefore relatively 
traceable to the catastrophic events It caused. 

The EM spectrum associated with radio frequencies Is vast. The 
radio frequency/electromagnetic (RF/EM) field strength from 
numerous sources (measured In volts per meter) varies widely. 
Figure 3.3-4 shows various sources associated with the RF 
spectrum. Figure 3.3-5 shows the envelope of peak field strengths 
that could be encountered within the U.S, U.K. and France during a 
flight scenario. While all aspects of a flight scenario are 
vital, the takeoff and landing portions exhibit the most potential 
for catastrophic occurance due to the short reaction times. 
Therefore absolute safety In takeoff and landing environment shown 
In Figure 3.3.5 must be assured. 

The wiring lengths (of Interest from an RF coupling perspective) 
anticipated to be encountered within aircraft of the MD-91 size 
class will be roughly In the 0.5 m to 50 m range. This translates 
to resonant frequencies of 300 MHz to 3 MHz, respectively. 

Aircraft wiring resonances could Increase the Induced voltages 
produced by external RF to as much as 30 volts (as compared to the 
less than 1 volt that would occur at nonresonant frequencies). 
Induced voltages will be present as long as the Interfering RF 
persists. The spectrum of RF energy that penetrates aircraft 
wiring and electrical/electronic systems can be summarized In 
three basic areas: 

A. RF energy below 1 MHz - Induced coupling at these frequencies 

Is Inefficient and thus will probably be of lesser concern. 

B. RF energy between 1 and 300 MHz Is of major concern as 

aircraft wiring at these frequencies acts as a highly 
efficient antenna. 

C. RF energy coupling to aircraft wiring drops off at frequencies 

above 300 MHz. At these higher frequencies the EM energy 

tends to couple through box apertures rather than through 
aircraft wiring. 
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TIME (US) 


CHARACTERISTIC OF FIRST RETURN STROKE FRONT 
RAMP (R ( ) AND SUBSEQUENT STROKE FRONT RAMP (R s ) 
AS MEASURED BY WEIDMAN AND KRIDER (1978) 

E-FIELD AMPLITUDES ARE NOT TO SCALE WAVE- 
FORMS ARE BASED ON MEAN VALUES OF HISTOGRAMS 
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FIGURE 3.3-1 

Waveshape of Two Natural Lightning Events 
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ONE NOISE 3URST IS 20 PULSES IN 1 MILLISECOND. 




TWENTY-FOUR NOISE BURSTS DISTRIBUTED OVER A PERIOD OF UP TO 2 SECONOS. 

FIGURE 3.3-3 
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Multiple Stroke and Noise Burst Environments 


4788S 


3-8 


ORIGINAL page is 
of POOR QUALITY 


Fly-By-Light 

Technology Development Plan 


FINAL REPORT 
30 August 1990 


MEDIUM 

FREQUENCY 


HIGH 

FREQUENCY 


VERY HIGH 
FREQUENCY 


ULTRA HIGH 
FREQUENCY 


SUPER HIGH 
FREQUENCY 


HF-VHF SPECTRUM 


aircraft and wiring predominant resonant frequencies^ 

2d 


AMERICAN NATIONAL STANDARD SAFETY LEVELS 
SPAN OF LOWEST LEVELS 


“1 

I 

DOMESTIC 
FM RADIO 
BROADCAST 


AUTOMATIC DIRECTION 
FINDER (ADF) 


| 

i 

DOMESTIC 
AM RADIO 
BROADCAST 

~rl i i 


HF COMMUNICATION 


MARKER 

BEACON 


PUBLIC SAFETY 
POLICE FIRE 
SERVICES 


Mill Mil — H -rYmn — f-| n i 1 1 m 

2 3 4 5 8 7$9 2 3 4 5 8 789 2 3 4 5 6 789 



UHF 

TELE- 

VISION 


RADAR 

ALTIMETER 


WEATHER 

RADAR 


Iglioeslope 


L 

BAND 
[RADAR I 


S 

BAND 
RADAR | 


C 

BAND 

RADAR 


I 2 3 4 5 6 789 f 2 3 

00 kHz 1 MHz 


100 MHz 


91 

1 GHz 


T I I I Mil 

2 3456 789 


10 GHZ 


ITT 

4 3 2 

[TT7TI 1 1 1 

1987 8543 2 

“IIIMMI 1 

1987654 3 2 

“ INI Mill 

1987654 3 2 

300M 

100M 

10M 

1 M 


DECAMETRIC WAVES 


METRIC 


DECIMETRE 


CENTIMETRfC 


P5420-16-20* 


FIGURE 3.3-4 


Sources Associated with Radio Frequency Fields 


ORIGINAL PAGE IS 
OF POOR QUALITY 


4788S 


3-9 




Fly-By-Light 

Technology Development Plan 


f. 

FOLDOUT FRAME 



P$420-1*-2S# 


3-/0 A 



- 2 . 

FOLDOUT FRAME 



FIGURE 


FINAL REPORT 
30 August 1990 


3.3-5 


Peak RF Field Strength Envelope 



Fly-By-Light 

Technology Development Plan 


FINAL REPORT 
30 August 1990 


3.3.2 EME Threat (Continued) 

Figure 3.3-6 shows (In the frequency domain) the lightning and 
HERF components of the EME threat. The points that make up each 
curve were derived by normalizing the threats to their equivalent 
magnetic field spectral density at a fixed bandwidth of 1 KHz 
(amps/meter/kl lohertz) . The HERF spectral envelope was derived by 
assuming a far-fleld source modulated 100% by a 800 Hz square wave 
with a carrier frequency equal to the frequency at which the 
evaluation Is made. 

3.3.3 Response to EME Threat 

It Is clear that the of EME threats to avionic systems, either 
digital or analog, are numerous. Although both types of avionics 
system respond to the same threats, there are factors that make 
the threat response to a momentary transient far more serious In 
digital systems than In analog. For example, the Information 
bandwidth and, hence, the upper noise response cutoff frequency In 
analog devices Is limited to, at most, 5 MHz, whereas In digital 
systems It Is often In excess of 100 MHz. This bandwidth 
difference, which Is at least ten times more severe In digital 
systems, allows substantially more energy and types of energy to 
be coupled Into the digital system. Moreover, the bandwldths of 
analog circuits associated with autopilot and Flight Management 
Systems (FMS) are on the order of 50 Hz for servo loops and much 
less for other control loops (less than 1 Hz for outer loops). 

Thus, If the disturbance Is short relative to significant system 
time constants, even though an analog circuit device possessing a 
broad bandwidth Is upset by an EM transient, the circuit will 
recover to the proper state. Unlike analog circuits, digital 
circuits and corresponding computational units, once upset, 
probably will not recover to the proper state and will require 
external Intervention to resume normal operation. 

It should be noted that In older digital systems using discrete 
transistor devices the transient energy necessary to cause an 
upset Is on the order of 10~ 5 J. With the advent of VHSIC 
technology digital systems, upset occurs at only 10 y J or 
less. This means that advanced technology systems will be four 
orders of magnitude more sensitive to upset. In addition, these 
digital devices can now be upset by transient disturbances that 
last less than 2 nsec; previously, the disturbance had to last a 
few microseconds to cause upset. Such upsets refer to digital 
devices, that have been set to an Illegitimate state which Is 
correctable (the device Is still operational, as opposed to, 
component damage which Is a permanent failure state and the device 
Is no longer operational), are, In turn, referred to as soft 
faults . 
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3.3.3 Response to EME Threat (Continued) 

In a normal operating environment, the occurrence of soft faults 
within digital processing systems Is relatively Infrequent and 
random. The condition should be treated as probabilistic In 
nature. From this perspective, the projected effect of a 
substantial Increase In the severity of the EME would be an 
Increased probability of a soft fault occurrence. That Is, In 
reality a soft fault may or may not occur at any particular point 
In time, but that on the average soft faults would occur more 
frequently with the new environmental level. 

The criticality of functions would be the main factor that 
determines the degree of EME protection for the design associated 
with that function. To achieve a satisfactory degree of safety, 

It appears that all EME protection options available will be 
necessary for flight critical systems such as full authority 
digital engine control or FBW primary FCS. 

3.3.4 System/Topology Approach to EME Immunity 

A balanced approach, that would be conducive to an optimum 
protection design. Is to view the protection objective from a 
system topology perspective. From this perspective, the aircraft 
Is mapped Into topology zones that contain a decreasing fraction 
of the energy and corresponding effect associated with the 
EME threat. These zones or regions are enclosed by boundary 
layers that provide the energy attenuation. Such boundary layers 
could even be extended to the regions within avionic equipment. 
Within the aircraft the layers would be provided through a variety 
of aircraft design options (e.g., line filters. Isolation 
transformers, fiber optics, cable shield, equipment enclosures, 
and the airframe materials). Within equipment similar layers 
would be provided by equipment design options (e.g., Interface 
circuit configurations, compartmentallzatlon, shielded modules, 
optical couplers, circuit board layout, wire routing, 
hardware/software architectural provisions). 

Figure 3.3-7 Is a system level (block diagram) overview 
representation of the transfer processes associated with the 
Interaction between EME and a flight critical system. Both the 
transfer process and the topology perspective emphasize the system 
level nature of the EME threat Issue and they are complementary. 

Figure 3.3-8 Is a representation of an aircraft electrical/ 
electronic system from a topological perspective. The figure 
shows typical Items corresponding to electromagnetic 
considerations. Isolation of zones or topology levels must be 
maintained by Isolating power ground from signal grounds, primary 
and secondary power Isolation, single point circuit ground and 
cable shields peripherally terminated (not necessarily grounded), 
at a minimum, at both ends. 
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3.3.4 System/Topology Approach to EME Immunity (Continued) 

Within the topology framework the effectiveness and necessity of 
various options could be assessed through appropriate trade 
studies . 

Immunity of electronic components to damage Is a consideration 
that occurs as part of the circuit design process. This circuit 
characteristic (Immunity to damage) Is Influenced by a variety of 
factors: circuit Impedances (resistance, Inductance, capacitance) 

which may be distributed as well as lumped; the characteristic 
(surge) Impedance of wiring Interfacing with circuit components; 
properties of the materials used In the construction of a 
component (e.g., thick fllm/thln film resistors); threat level 
(open circuit voltage/short circuit current) resulting In a 
corresponding stress on Insulation, Integrated circuit (IC) leads, 
printed circuit (PC) board trace spacing, etc.; and semiconductor 
device nonl Inearltles (e.g., forward biased junctions, channel 
Impedance, junction/gate breakdown). Immunity to upset for analog 
processors Is achieved through circuit design measures, and for 
digital processors It Is achieved through architectural as well as 
circuit design measures. 

The use of composite materials In aircraft construction, 
electronic computers that use VLSI-type electronic devices, and 
reliance upon electronic computers for flight critical functions 
are recent technology trends that have greatly magnified the 
threat of EME relative to aircraft operations. As previously 
noted, although a momentary (less than 1 sec) threat may cause 
disruption In both analog and digital systems, analog systems 
generally resume normal operation when the threat Is removed. 
Digital systems, on the other hand, when once perturbed, require 
external Intervention to resume normal operation. Unless 
substantial fault tolerance Is built Into It, the digital system 
Is far more susceptible to system upset by momentary threats than 
Its predecessor analog device. 

When the threat Is not momentary, analog systems that contain VLSI 
devices (e.g., operational amplifiers, comparators) will, 
depending upon the amplitude of voltages/currents produced by the 
threat, be disrupted and may take a substantial length of time to 
recover to normal operation after the threat subsides. Digital 
system disruption Is a probabilistic matter and may or may not 
occur. Thus, for nonmomentary EME threats, digital systems may 
offer more promise of achieving system Immunity than their analog 
counterparts . 

As a general rule, optimum EME protection (hardening) occurs when 
the protection burden Is partitioned among the various options 
available. An approach to optimum protection design Is to view 
protection from a system topology perspective. It should be noted 
once again that It appears that use of all possible options may be 
necessary to achieve an acceptable confidence level for 


4788S 


3-16 



Fly-By-Light 

Technology Development Plan 


FINAL REPORT 
30 August 1990 


3.3.4 System/Topology Approach to EME Immunity (Continued) 

critical systems (e.g., full authority engine control, FBW primary 
flight controls). If protection requirements are allocated In an 
optimum matter, the Impact of EME protection on airplane costs 
(weight, power, performance, monetary) will be minimized and the 
degree of Immunity to lightning and RF effects Is maximized. 

Ideally, system Immunity to EME threat should be achieved through 
system design measures that provide sufficient Inherent Immunity 
so that reliance on dedicated protection devices can be 
minimized. Such protection measures tend to be self-monitoring 
through noticeable degradation or actual loss of system function 
when a protection measure has been degraded or lost. 

When balanced protection Is distributed throughout the various 
levels of a FBL system methodologies and capabilities, 
corresponding to the nature of such a protection strategy, must be 
available to verlfy/valldate that the desired degree of Immunity 
to the EME threat has been achieved. Such capability would need 
to be broad In scope and based upon a top down approach. It Is 
perceived that assessments from the device/circuit level would 
need to be Integrated Into subsystem and system level assessments. 

3.3.5 State-of-the-Art of EME Analysis for Aircraft 
3. 3. 5.1 The Role of Analysis 

A fundamental understanding of the propagation of EM energy. Is 
the contribution of an analytic resource to the EME effects 
assessment process. Analysis Involves the systematic application 
of electromagnetic physics and associated mathematical models. 
Empiric (testing) activity contributes the data from 
electromagnetic measurement based upon experimentation under 
controlled laboratory conditions. There should be a complementary 
Interplay between analysis and test throughout the assessment 
process . 

Although analysis can now play a major role In aircraft 
validation, Its potential has not been realized. However, the role 
of validation Is expected to Increase In the future. For several 
reasons : 

A. High fidelity mock-ups suitable for testing are frequently not 
available. It Is expensive to develop mock-ups only for 

EM evaluation purposes. Also, testing of airworthy prototypes 
can usually only be done at reduced levels because of concern 
that the testing may damage the prototypes. 

B. Analysis Is generally less expensive than testing. 

C. Analysis can be done using design drawings as Input; the 
hardware need not exist, and parametric variations can be 
easily done. 
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3.3. 5.1 The Role of Analysis (Continued) 

D Because of the advanced state of numerical/analytical 

techniques relative to the limitations In test techniques and 
Instrumentation, confidence In analysis results can be 
equivalent to that of test results. 

E. Analysis tools are expected to become more accurate In the 
future since the accuracy of the numerical tools Is presently 
limited by available computer capability. Computer capability 
Is rapidly Increasing, which continues to make analysis more 
accurate and cost effective. 

Because of the above reasons, analysis will play the following 
role: 

1. Design: Analysis can be used to evaluate designs and 

perform trade studies. Analysis can be used to Identify 
the critical areas which require more design attention 
and provide a high payback In EM hardness. 

2. Definition of Line Replaceable Unit (LRU) Electromagnetic 

Specifications (EMS): Analysis can be useful In the 

development of voltage, current, and EM field 
specifications for LRUs. 

3. Evaluation of EM Environment Mitigation Practices: 

EM environment mitigation practices, such as volume and 
cable shielding, and terminal protection designs can be 
evaluated by analysis. 

4. Test Planning: It Is not recommended that analysis 

completely replace testing. Both testing and analysis of 
systems or subsystems should be done, although the role 
of analysis will be Increasing. The first role of 
analysis In this regard Is to help with test planning. 

The analysis can Identify potentially weak areas of the 
system design which should be further Investigated by 
tests. The test setup can be analyzed and meaningful 
test points and expected response levels can be 
Identified. 

5. Data Interpretation: Because modern aircraft are such 

complex systems, test data Is often difficult to 
understand, especially with CFC/metal structures. 

Analysis can help In understanding the data and the 
related physical EM Interaction processes. 

6. Aircraft Validation and Certification: Although partly 

alluded to In the previous discussions. It should be 
emphasized that analysis can be used to help validate and 
certify aircraft. It Is expected that analysis will 
assume a bigger role In the future. 
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3. 3. 5. 2 Analysis State-of-the-Art 

The Issues of Interest for EM analysis Include the coupling to the 
aircraft surface and structure, the penetration through seams and 
apertures, and propagation along and through cable bundles. 
Techniques exist for analysis of all these Issues. The 
EM analysis approaches must also have the ability to study the 
peculiarities of lightning. Including channel attachment 
geometries, as well as the RF illumination of an aircraft In free 
space or on the ground. Both transient and CW results are 
requl red . 

It Is not the Intent here to provide a detailed technical review 
of each available analysis technique. Instead the purpose Is to 
review the general capabilities and deficiencies. 

First of all. In order to cover the lightning and HERF 
environments, one must note the large frequency range. The 
HERF environment Is basically a CW or modulated CW having carrier 
frequencies between 15 KHz and 40 GHz. The lightning environment 
Is a transient current waveform having significant spectral 
content from DC to about 30 MHz. There presently Is not a single 
technique which can be used to completely solve the EM Interaction 
problem for an entire aircraft all at once. However, certain 
related significant statements can be made: 

A. Numerical techniques exist which could completely solve the 
entire Interaction problem all at once over the desired 
frequency range If there were unlimited computational power. 
That Is, the present limit of the application of numerical 
solutions to Maxwell's equations for entire aircraft Is caused 
by limits In computer memory and speed. For example, with 
available supercomputers (e.g., Cray II), the Three 
Dimensional Finite Difference (TDFD) approach can accurately 
determine the response from DC to about 200 MHz for commercial 
size aircraft. Results up to 100 MHz can now also be obtained 
with minicomputer technology. Accuracy of this approach has 
been validated In numerous Instances. Significant amounts of 
detail can also be put In this model. Including apertures such 
as windows, the structure of the Interior, and Internal 
cables. The Inside, outside and cable propagation, are solved 
self consistently and simultaneously, thus eliminating two or 
three extra calculations. Both time and frequency domain 
responses are used to analyze aircraft sub-elements , such as 
LRUs, modules, PC cards, and localized Points of Entry (POE) 
on aircraft surfaces. Thus, an Important part of the spectrum 
Is already covered by existing technologies, and the upper 
frequency limit will Increase with Increased computer 
capability. 
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3. 3. 5. 2 Analysis State-of-the-Art (Continued) 

The required Increase In computational power to completely 
solve a commercial aircraft up to 40 GHz can be estimated. 

For the TDFD approach, for example, the memory requirements go 
up as the cube of the upper frequency limit (for the same size 
object), and the computation time requirements Increase as the 
fourth power of the upper frequency limit. Therefore, If 
present technology limits the upper frequency to 200 MHz, and 
the goal Is 40 GHz (factor of 200) memory requirements will 
have to Increase by a factor of 8 X 10 , and computer speeds 
will have to Increase by a factor of 1.6 X 10 9 . These are 
huge numbers; however one may reasonably expect that within a 
few years, the upper bandwidth may be extended to 1 GHz 
(factor of 5), because of advances In supercomputer technology. 

B. It Is not necessary (although It would be nice) that the 
entire aircraft Interaction problem be solved all at once for 
all frequencies. As mentioned above, present techniques are 
band limited by computer capability to about 200 MHz, but 
fortunately, however, all of the major structural resonances 
of the aircraft are below this frequency. This means that for 
the higher frequencies It Is not necessary to Include the 
entire aircraft In the coupling problem. For example, 
coupling through a cockpit window with 10 GHz RF Illumination 
Is fairly Independent of aircraft length and geometry, whereas 
this would not be the case at 3 MHz, especially If this were 
the first fuselage resonance frequency. 

C. Techniques are available which can be used to solve the upper 
frequency parts of the Interaction. As mentioned, It Is not 
necessary to have the entire aircraft In the problem space. 

In the example given In B. above, for example, the T0FD 
approach can be now used to solve the coupling at a more local 
level. Other techniques also exist such as Geometrical Theory 
of Diffraction (GTD) , physical optics, method of moments, and 
finite elements. 

In addition to the computational capability limitations, there are 

several other limitations as well: 

D Present algorithms are not user friendly. Generally speaking, 
the use of sophisticated numerical analysis techniques Is done 
by skilled EM theoreticians with extensive computer skills. 
Although there are on-going efforts to make these tools 
friendly, much work needs to be done In the following areas: 

1. Input of Geometry and Materials: Work needs to be done 

In this area In which the user enters the aircraft shape 
and materials. A CAD/CAM type of front end needs to be 
developed which would make this a relatively painless 
process. This would also Include Internal cables, and 
details of apertures, etc. 
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3. 3. 5. 2 Analysis State-of-the-Art (Continued) 

2. Debugging Capability: Capability needs to be built Into 

the software to tell the user of faults within his 
problem. This can Include help menus and Information 
such as the viability of his Input data, possible 
locations of sources of Instabilities or Inaccuracies, 
possible problems with boundary conditions, and others. 
The Idea Is to relax the requirement that the user be an 
expert EM technologist. 

3. Interactive Graphics Output: High quality Interactive 

graphics output Is required. 3D plotting routines, 
videos showing temporal response development, and similar 
capabilities are required to help the user easily 
visualize his data. Output points should be mouse or 
menu selected. Instead of by Inputting x, y, z 
coordinates . 

E. High frequency models have not been fully developed. As 
mentioned earlier, present techniques may now be accurately 
applied to jumbo jet size aircraft up to 200 MHz. This Is 
primarily because much effort has been spent on developing 
models for lightning and Nuclear electromagnetic Pulse (NEMP), 
while the HERF environments have not been as thoroughly 
considered. Therefore, development and applications of models 
In these frequency regions to the aircraft hazard evaluation 
problem Is rather new territory. 

F. The EM description of an aircraft Is often not known In great 
detail. This problem Is not associated with the techniques 
themselves, but Is associated with the Input data. For 
example, the layout of cables and branches within an airframe 
Is not well controlled and Is difficult to define. The 
termination Impedances are also difficult to determine. The 
same Is true with regards to bulkhead locations, box (LRU) 
locations, and the like. Even though the numerical methods 
may be capable of analyzing the configuration, the results 
cannot be more accurate than the Input data. 

Two aspects of this problem need some discussion. First, one 
may question the need to know this detail. Historically, the 
approach has been to make worst case or typical models, and 
this Is generally thought to be adequate. However, If the 
results are too worst case, unacceptable hardening penalties 
may result. 

Second, the approach has not been adequately verified on a 
full scale aircraft. Therefore the possible hardening 
penalties mentioned above have never been quantified. 
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3.3. 5.2 Analysis State-of-the-Art (Continued) 

G. The models need extensive validation to be accepted by the 

community. Validation of the TDFD approach under a variety of 
circumstances has been accomplished. While the results from 
this validation effort have been encouraging, none of the 
cases examined Included coupling to the cables and LRU pins 
within commercial aircraft. Also, validation was achieved at 
relatively low frequencies (appropriate for lightning and 
NEMP), and there Is none at the higher frequencies. 

Therefore, an extensive effort must be made to validate the 
models and quantify the errors. 

3.3.6 Approach for the Development of an EME National Resource 

3. 3. 6.1 Introduction 

The proposed technical approach for this program Is summarized In 

Table 3.3-1. The essential features of this approach are as 

follows: 

A. To provide a credible solid technical scientific basis for the 
EME national resource, the program emphasizes the development 
of first principle EME models and rigorous testing for 
validation. 

B. The development of a 1/10 scale model facility Is 
recommended. This requires a scaling of the frequency along 
with the physical scaling of the model. A 1/10 scale model 
requires Illumination frequencies that are ten times larger 
than actual frequencies for full scale aircraft. Thus, with a 
40 GHz facility, scale model aircraft Interaction studies can 
economically be accomplished for a variety of sources and 
aircraft geometries and orientations for frequencies below 

4 GHz (1/10 scale Illumination frequencies below 40 GHz). 

C. The scale model facility will also be used to evaluate 
Interactions with full scale LRUs, cable assemblies, and 
printed circuit cards up to 40 GHz. 

D. A full scale test bed will also be used for validation at the 
low frequencies and also up to 40 GHz. 

E. In addition to the EME models, another valuable product will 
be produced, which Is a definition of threat levels Inside 
aircraft for lightning and HERE environments. 

F. The program's main output will be a set of scientifically 
validated user friendly EME Interaction codes. 

G. LRU/aircraft test and verification methods will be developed. 

H. The project should be validated with the flight test aircraft 
In a ground test demonstration. 
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TASK DESCRIPTION OBJECTIVE 


1. Development of Interaction Technology 

1.1 Literature Review 

1.2 Selection of Models 

1.3 Nuaerical Model Development 


2. 

Seal* Model and Sifc-Eleaent Facility 
Development 


2.1 

Requirements Definition 


2.2 

Hardware Design 


2.3 

Software Design 


2.4 

Measurement Tool Development up 
to 40 GHz 


2.5 

Procurement /Assembly 


2.6 

Cal ibration/Checkout 

3. 

Seal* Nodcl/Sifc-Eleaant Valient ion 


3.1 

Design of Three (3) Physical 
Aircraft Models 


3.2 

Procurement/Construction of the 
Three (3) Mode Is/ Sub- Elements 


3.3 

Pretest Analysis 


3.4 

Teat Planning 


3,5 

Teat Conduct 


3.6 

Data Analysis 


3.7 

Reporting 


3.8 

Intaraction Model Modification 

4. 

Full 

Scale Test Bed Development 


4.1 

Test Bed Aircraft Selection 


4.2 

Measurement Tool Development up 
to 40 GHz 


4.3 

Facility Design 
(Hardware/Software) 


4.4 

Assembly 


4.5 

Cal ibration/Checkout 

5. 

Full 

Scale Validation 


5.1 

Pretest Analysis 


5.2 

Test Planning 


5.3 

Test Conduct 


5.4 

Data Analysis 


5.5 

Reporting 


5.6 

Interaction Model Modification 

6 . 

Threat Level Definition 


6.1 

Review and Correlate Previous 
Test and Analysis Data 


6.2 

Develop a Set of Threat Levels 
for Cable Coupling, Internal 
Fields, Internal LRU Levels, 
Suitable as a Basis for a Test 
Standard 

7. 

Cods 

Ertimncsmant 


7.1 

Add CAD/CAM Front End 


7.2 

Add debugging/Nelp Features 


7.3 

Interactive Graphics Output 

8 . 

Test 

Method Development 


8.1 

Define Methods Based on Threats 


8.2 

Banch Tast Validation 


9. Flight Tost Demonstration TABLE 3.3-1 
EME National Resource Development: 


To determine and develop the best 
numerical models to be used in the 
National Resource 


To define and build a scale model 
facility to cover approximately 0 to 4 
GHz for full size aircraft, and 0 to 40 
GHz for sub-elements (LRUs, cables, 
assemblies, printed circuit boards, etc.) 


To validate and improve EME interaction 
models and mitigation practices ip to 
approximately 4 GHz for full size 
aircraft and 0 to 40 GHz for sub-elements 


To Define and implement a full scale test 
bed to cover frequencies up to 40 GHz for 
full size aircraft 


To validate and improve interaction 
models and mitigation models and 
mitigation practices ip to 40 GHz for 
ful l size ai rcraf t 


To define a set of standard threat levels 
for cable coupling, internal fields, etc. 
to form the basis of an integrated EME 
Standard 


To make the nuaerical analysis codes user 
friendly and well documented 


To develop test methods for LRU/ai rcraf t 
EME testing 


To demonstrate that results and 
methodology apply to airworthy aircraft 

Program Plan Overview 
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3. 3. 6.1 Introduction (Continued) 

Many of the Items In Table 3.3-1 are self-explanatory. However, 
expansion of some of the key features Is presented. 

3. 3. 6. 2 Interaction Technology Development 

In Task 1, and In many of the following tasks, attention will be 
given to the development of numerical EME Interaction models. At 
first a literature search will be done, with particular emphasis 
at the higher frequencies. A set of numerical models will be 
determined and developed. They will be modified as appropriate by 
the test results. 

3. 3. 6. 3 The Scale Model and Sub-Element Test Facility 


3. 3. 6. 3.1 Purpose 

This facility will conduct EME tests up to 4 GHz for 1/10 scale 
aircraft models In support of numerical models and to obtain data 
for establishing threat levels. The tests Include CW Illumination 
and direct current Injection. In addition, full scale testing up 
to 40 GHz will be conducted for LRUs, cable assemblies, and 
printed circuit cards. 

The facility description will address stimulus equipment, the 
physical scale models, measurement probes and sensors and data 
acquisition equipment. 

3. 3. 6. 3. 2 Stimulus 

The stimulus equipment In the facility will generate and apply 
swept CW fields to reduced scale aircraft models. This equipment 
will be reconfigured for current Injection to simulate lightning. 
The stimulus generation equipment consists of network analyzers 
and RF amplifiers. 

The stimulus fields are applied to the models by means of a 

parallel plate line and a log periodic antenna. Lightning 

currents are simulated by direct Injection of CW test currents 
Into the model . 

A. Parallel Plate Line: The parallel plate transmission line 

shown In Figure 3.3-9 will be used for frequencies up to 

100 MHz. The aircraft will be Initially replaced by a 
reference probe to calibrate the Illumination signal with the 
power reference. The reference probe will be Inserted In a 
similar manner to the aircraft. Once the calibration has been 
obtained, the reference probe will be removed and replaced by 
the aircraft model. The dimensions of the line will be 
determined by pretest analysis to optimize the useful 
frequency range. Reconfiguration of the termination end by 
absorber materials and/or opening the end will extend the 
upper frequency limit. 
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3. 3. 6. 3. 2 Stimulus (Continued) 

The response data from the aircraft can be taken out either by 
Fiber Optics Link (FOL) or by hard wire. The fiber optics 
approach Is the best from a purely EM point of view. There 
are two disadvantages, however. The first Is the cost 
associated with a FOL having several GHz bandwldths. The 
second Is that the FOL has a rather high noise floor, thus 
limiting measurement dynamic range. 

The data acquisition cables can be Isolated from the test 
object by the use of ferrite beads and RF chokes. The choke 
can be made by colling the cable around a ferrite material. 
Ferrite beads can be used directly on the cable for 
attenuation and Isolation. The cable can be geometrically 
attached to the test object In such a way that coupling to the 
cable Is very small. These attachment locations are at 
E_f 1 el d nulls on the test object, and are determined by 
analysis. The cable will also be oriented normal to the 
Incident field so that there Is very little coupling to It. 

The current on the cable will be measured during test setup to 
verify minimum Interaction. 

B Antennas: A log periodic antenna will be used to Illuminate 

the model, as shown In Figure 3.3-10, for frequencies above 
the capabilities of the parallel plate line up to 40 GHz. The 
model pictured In this figure will be Initially replaced by , a 
reference probe to calibrate the Illumination signal with the 
power reference. The reference probe will be Inserted In a 
similar manner to the aircraft. Once the calibration has been 
obtained the reference probe will be removed and replaced by 
the model. Data acquisition can be hard wired, with the same 
considerations as described for the parallel plate line, above 

C Simulated Lightning Current Injection (up to 300 MHz): 

Coaxial cables will connect the output of the RF amplifier to 
the aircraft models as shown In Figure 3.3-11. The point of 
connection will be at a probable lightning attachment 
location. Again, data acquisition will be hard wired. This 
Is easier In this case than It Is for the Illumination cases. 
Both the reference Injected current and the test point 
responses can be carried on shielded coaxes contained within 
an overall shielded cable which forms the lightning current 
detachment point, as shown. 
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Log Periodic Antenna for Frequencies from 100 MHz to 40 GHz 
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3. 3. 6. 3. 3 Aircraft Models 

Three aircraft models will be used to determine current and 
voltage amplitudes and electric and magnetic fields at the 
avionics. The aircraft to be modeled will be a 747 or a DC-10 
size, an MD-80 size, and a business size. It Is possible that the 
coupling can be studied for the smaller aircraft at higher 
frequencies than for the large aircraft due to a larger scale size 
for small aircraft. A B-747 has a length of about 70 M, which 
results In a 7 m fuselage for a 1/10 scale model, thus creating 
the need for a large parallel plate line to study all significant 
angles of Illumination. Scale size Issues will be resolved during 
the planning activity. The models will have scaled apertures, 
cables, and Internal LRUs and will be as high fidelity as 
possible. Skin thicknesses will not be scaled, and the models 
will not be used to study diffusion or current redistribution 
effects. These effects are especially Important for lightning and 
will be studied with full scale test articles. 

The reduced scale will allow the model to be oriented In each of 
three orthogonal directions In the transmission line and antenna 
Illumination cases, thereby assuring that all directions and 
polarizations are provided. The longest dimension on the model 
will be no larger than half the shortest dimension In the active 
area In the cell to minimize the field perturbations. The model 
will be large to provide adequate Internal volume for placement of 
the measurement probes and sensors. 

3. 3. 6. 3. 4 Measurement 

The use of scale models requires that the stimulus frequency be 
extended by the corresponding amount (l.e., 1/scale factor). 
Therefore, measurement Instrumentation must have adequate 
frequency response. In order to obtain currents, voltages and 
fields, the measurement probes and sensors will be made. 

A. Current and Voltage Probes: Because the avionics system Is 

the object to which the Internal fields Inside couple, the 
short circuit current and open circuit voltage probes will be 
built as simulated scaled avionics as shown In Figures 3.3-12 
and 3.3-13. Other avionics boxes are simulated by the load on 
the other end of the simulated cables. The current probe 
utilizes a 1 ohm resistor shunted to ground. The current 
measured by a 50 ohm Input network analyzer will thus be 
1 /50th of the actual current value. The voltage probe uses a 
1 k ohm resistor In series with the simulated cable to reduce 
the current and Increase the voltage thereby approaching the 
open circuit voltage value. 
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LOAD 

SIMULATED AVIONICS CABLE 





TO 50 Q NETWORK 
ANALYZER 


FIGURE 3.3-12 

Short Circuit Current Probe 


LOAO 

SIMULATED AVIONICS CABLE 

IkQ 

AAA 




TO 50 Q NETWORK 
ANALYZER 


P54 20-16-16# 


FIGURE 3.3-13 

Open Circuit Voltage Probe 
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3. 3. 6. 3. 4 Measurement (Continued) 

B. Field Sensors: Field sensors will measure the fields at the 

avionics box and act as a reference for the network analyzer. 
The electric and magnetic field sensors are Illustrated In 
Figures 3.3-14 and 3.3-15. The electric field probe Is 
monopole above a ground plane where the center conductor of 
the cable lead Is the antenna and the avionics box makes up 
the ground plane. Two such sensors will be needed. The 
first, as shown In Figure 3.3-14, will be rotated by 

90 degrees for two orthogonal electric field components. The 
second probe will be similar to the first except that the coax 
conductor will pass straight through the box and penetrate the 
vertical wall on the opposite side. This sensor will measure 
the third orthogonal electric field component. The magnetic 
field sensor Is a semicircular current loop. Three such 
sensors will be needed, one for each of the three orthogonal 
field orientations. 

C. Probe and Sensor Cables: The cables which conduct the probe 

and sensor signals to the network analyzer will be made of SMA 
semi-rigid coax. The points on the scale model where these 
cables penetrate the skin will be chosen to minimize the 
perturbations of the surface current density and where the 
minimum electric fields have been Identified by numerical 
modeling results. The points chosen will be different for 
different scale model orientations In the Illuminating fields 
and for the Injected current configurations. The shields on 
the cables will be shorted to the Inside surfaces of the scale 
model metal struts. The cable exit from the scale model will 
be through a connector jack placed on the outside surface of 
the skin. When a given connector Is not In use a metal cap 
will cover the connector thereby shielding the center 
conductor of the probe/sensor from stray fields. For the 
cable shield outside the scale model, an RF choke will be 
Incorporated Into the cable. Within 3 Inches ( G/4 for 

f = 1 GHz) of the connector the semi-rigid coax cable will be 
colled Into several turns to block the RF signal on the shield 
of the coax cable. The optimum Inductive reactance will be 
determined, but as an example, 6 turns with radius of 25 cm 
will provide 50 ohms at 10 MHz. In order to further minimize 
the RF signals coupled to the cable shields, the cables will 
be laid out for the parallel plate line and the log periodic 
antenna Illumination areas with orientations perpendicular to 
the electric fields produced by the test equipment. 

3. 3. 6. 3. 5 Data Acquisition 

The data acquisition system will consist of the receive circuits 
of the network analyzers, attenuators, a personal computer based 
system controller/VAX terminal and Interface and local mass data 
storage. An 80 dB screen room will contain this system as 
discussed In Subsection A. below. The network analyzers will be 
selected during procurement of the data acquisition equipment. 
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L = (10 INCHESVs 
n = c/4 

s = SCALE FACTOR 



TO NETWORK ANALYZER 


FIGURE 3.3-14 
Electric Field Probe 


L = <10 INCHESVs 
a - l 4 

s = SCALE FACTOR 




TO NETWORK ANALYZER 


P5420-16-15# 


FIGURE 3.3-15 
Magnetic Field Probe 
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3. 3. 6. 3. 5 Data Acquisition (Continued) 

Figure 3.3-16 shows a functional block diagram of the data 
acquisition system. 

A. The data acquisition system will be contained In an 80 dB 
shielded room or enclosure. The shields of the cables that 
pass through the enclosure wall will be shorted to the Inside 
or outside of the wall for cables on the Inside or outside, 
respectively. The enclosure will be adequately grounded. 

B. Attenuators: 60 dB of swltchable attenuation will be provided 

for the Inputs to the network analyzer. This will assure a 
safety margin for the network analyzer. 

C. Data Acquisition Controller: The system controller will be 

personal computer/microcomputer based. The network analyzer 
and attenuator control Interfaces will be IEEE-488 
Implementations. The controller will be programmed to control 
the test Initiation, the frequency step size and sweep speed. 
Signal to noise ratios will be monitored and the attenuators 
adjusted for optimum S/N If adequate signal levels can be 
maintained. At the completion of the sweep the data will be 
stored on local mass storage and then uploaded to the VAX 
computer by means of RS 232 serial Interface In the personal 
computer. Custom software will be written to Implement the 
control, monitoring and data manipulation. 

3. 3. 6. 3. 6 Full Scale Sub-Element Testing 

The facility would also have the capability of testing aircraft 
sub-elements at full scale up to 40 GHz. One can evaluate cable 
coupling, mitigation techniques, shielding of LRU enclosures, and 
coupling to printed circuit (pc) boards. 

3. 3. 6. 4 Full Scale Validation 

A full scale test bed will need to be developed to extend the 
coupling validation to aircraft at the higher frequencies. Much 
of the same Instrumentation previously obtained can be used here. 
The full scale test bed will also be used to spot check some of 
the lower frequency scale model results at lower frequencies. 

A full scale test bed Is envisioned to consist of a full size 
aircraft (not necessarily airworthy), plus perhaps some full scale 
major aircraft structures (such as a wing). Here Is where the 
Impact of composite structures will also need to be examined. 

3. 3. 6. 5 Threat Level Definition 

One of the outputs of this effort will be a detailed knowledge of 
Internal EM environments, such as the current, voltages, and field 
levels. These levels can then be used to define waveforms 
suitable for LRU standards and testing specifications. 
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SCALE MOOEL 
P5420-16-14# 


FIGURE 3.3-16 

Functional Block Diagram of the Data Acquisition System 
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3. 3. 6. 6 


3. 3. 6. 7 


3. 3. 6. 8 


3.3.7 


3.4 


4788S 


Code Enhancements 

Once the technical features of the code are In place, the next 
step Is to make them user friendly as described In Task 7. The 
Intent here Is to make the codes easily usable to someone who Is 
not an EH theoretical expert. 


Test Method Development 

Another major output of this effort Is the development of aircraft 
EME test methods. The Intent here Is to define LRU specifications 
and test methods so that entire aircraft testing will not be 
required for certification. 


Aircraft Demonstration 

The methodology will be applied to the EME hardening of a 
demonstration aircraft. Its EME hardness will be demonstrated by 
the analysis and test methods developed under this effort. The 
approach here Is to perform the EME demonstration with a ground 
test that covers HERF and lightning. A full up airworthy vehicle 
with all systems powered and functional will be the test object. 
Test planning and analysis activities will be done to ensure 
proper test configurations and procedures so that the test results 
are applicable to an In-flight aircraft. 

EME Protection Technologles/Approaches 


Listed below are some EME protection approaches. 


CONVENTIONAL 


EMERGING TECHNOLOGIES 


Shielding 
Filtering 
Redundancy 
Mechanical Controls 
(Including Hydraulic) 
Diversion Paths 
Grounding 

Balanced Circuitry 
Electrical Bonding 
Location 


Fiber Optics 
Transparent Recovery 
Software Tolerance 
Reconfiguration 
Hardened ICs 
Conductive Composites 
Immune Electronic Backup 
Optical Computing and Storage 


Fiber Optics/Optics 

Over the past decade the effort to develop aircraft suitable fiber 
optics has grown exponentially. These efforts have provided 
aircraft systems designers with a host of new fiber optic 
components, cables, sensors, switches, and data links/buses needed 
for viable FBL systems. Table 3.4-1 provides a very partial list 
of fiber optic developments. 
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FIBER 


High Temperature Glass and Plastic 

Improved Bend Radius 

Radiation Hardened 

Polarization Preserving 

Ribbon 

CONNECTORS 


Vibration and Shock Resistant 
Repeatable Terminations 
Crimp and Cleave 
Environmentally Sealed 
Temperature Insensitive 
Ribbon 
Multipin 
MIL-STD 

Automated Termination 
Reduced Loss 

COUPLERS 


Temperature and Shock Resistant 

Etched Glass 

Temperature Insensitive 

Multichannel Wavelength Division Multiplexers 

Improved Packaging 

Reduced Loss 

EMITTERS/DETECTORS 

Improved Launch Power/Sensitivity 
Reduced Electrical Power Consumption 
Reduced Temperature Drift 

SENSORS AND SWITCHES 

Viable Optical Powering 
Digital and Analog Techniques 
Improved Performance and Reliability 
Parameter Sensitive 


OTHER 


Integrated Optics 
Smart Skins 
Optical Computing 


TABLE 3.4-1 

Partial List of Fiber Optic Developments for Aircraft 
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3.4 Fiber Optics/Optics (Continued) 

While current fiber optics for aircraft have ample room for 
improvement In terms of manufacture, Installation, reliability, 
and maintainability, they are mature enough for Implementation on 
a limited basis to address some particularly troublesome problems. 

A wide variety of potential benefits are commonly attributed to 
the application of fiber optics as noted In Table 3.4-2; but EMI 
protection, potential weight savings, performance requirements, 
and higher data rates are driving FBL. 

3.4.1 Optical Data Bus 

The following fiber optics data bus Issues have received a great 
deal of attention, but have not been resolved: 

A. Splitters/Coupler: Fused couplers are sensitive to humidity. 

Grating types are sensitive to vibration and shock. 

B. Light Sources/Detectors: Temperature range Is a significant 

problem. LEDs lack reliability at high temperatures, while 
lasers and photo detectors exhibit wavelength drift with 
temperature variations. Peltier elements are sometimes 
required for cooling or temperature stabilization. They are 
unreliable and Introduce added complexity to a system. For 
wavelength discriminating sensor methods, a reliable, stable, 
sold state broadband source Is needed. 

C. Connectors/Terminations: Further progress must be made before 

fiber optics can be generally considered for commercial 
aircraft Installation. Generally the available systems lack 
reliability; some specific problems are listed below: 


1 . 

High Insertion losses 


2. 

Loss variability from connector 

to connector 

3. 

Unrepeatable losses for reconnect 

4. 

High aging losses 


5. 

Connector back reflection 


6. 

Sensitivity to small amounts of 

contamination 


A major concern Is that current technology, particularly with 
regard to connectors, uses adaptations of electrical technology 
which do not address the unique properties of optical fibers. In 
addition, there Is a lack of standardization among airframe 
manufacturers and fiber optic technology developers. 
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SIMPLIFICATION BENEFITS 

WEIGHT 

LESS CABLE 
LIGHTER CABLE 
NO CABLE SHIELDING 
FEWER CONNECTORS 

RELIABILITY 

FEWER TERMINATIONS 

CORROSION-RESISTANT 

CABLES 

INSTALLATION COSTS 
FEWER RUNS 
FEWER CLAMPS 

MATERIAL COSTS 
LESS CABLE 
FEWER CONTACTS 

DESIGN SIMPLIFICATION 

FEWER SIGNAL PATHS 
SIMPLER WIRING DIAGRAMS 


PERFORMANCE BENEFITS 

ELECTRICAL ISOLATION 

NO SPARK OR FIRE HAZARDS 

NO SHORT CIRCUITS 

NO GROUND LOOPS 

NO CROSS-TALK BETWEEN CABLES 

IMMUNITY TO EMI 

IMMUNITY TO LIGHTNING SURGE 
CURRENT 

WIDE BANDWIDTH 

GREATER TRANSMISSION SECURITY 


TABLE 3.4-2 

Variety of Benefits Attributed to the Application of Fiber Optics 
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3.4.1 


Optical Data Bus (Continued) 

Glass fiber Is Inherently fragile as compared to copper wire. 

This Is a factor which must be examined In attempting to adapt 
fiber optics to aircraft. Currently copper wires are assembled 
Into bundles using tie-wraps every few Inches. The bundles are 
Installed Into the aircraft sections after which the sections are 
joined and the wires mated via connectors. Repair can be 
performed by slicing or In some cases by pulling a new length of 

wl re. 


These Installation and repair methods may not be acceptable for 
fiber optics. The present system requires connectors at every 
aircraft section and optical systems are sensitive to connector 
losses. Tie-wraps may Induce microbending losses. Efficient, 
reliable splicing techniques for optical fibers have not yet been 
demonstrated, and pulling a fiber through a tightly wrapped bundle 
may cause breakage. 


Some work 1 
connectors . 
(12 optical 
terminated 
pol 1 shed . 

1 .4 pounds 
with copper 
optics to c 
optics to a 


s being advanced In the area of fiber optic 

DAC Is currently reviewing fiber optic ribbon cables 
fibers In a 1/4 Inch wide ribbon). All 12 fibers are 
as a unit with etched silicon wafers and then 
A 1/3 Inch diameter cable with 144 fibers weighs 
per 100 feet. This order of density Is not possible 
wire due to cross talk* The application of Integrated 
onnector technology Is a positive step In applying 
Ircraft use. 


Some of the other shortfalls of fiber optics In aircraft 
applications are: 


A. Large differences In path losses of linear and multlstar 
networks . 

B. Optical receiver limitations with regard to these large and 
varied path losses. 

C. Optical transmitter limitations of coupling sufficient power 
Into lossy networks. 

D. Difficult network Installation and uncertain reliability In 
avionic environments. 


First, the limitations of linear networks will be discussed. 

There are four basic linear topologies In consideration for a 
FBL System (see Figures 3.4-1 through 3.4-4). The shortfalls of 
these configurations are high path losses and large differences In 
path loss between adjacent terminals and widely separated 
terminals. The number of terminals which can be Implemented In a 
linear configuration Is limited due to receiver sensitivity and 
dynamic range, low coupled power from optical transmitters, 
connector loss and a system margin for aging. 
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FIGURE 3.4-3 

Dual K Configuration (One Bus Fibers) 



FIGURE 3.4-4 

Broken Linear Loop Configuration 
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3.4.1 


Optical Data Bus (Continued) 

To analyze this problem quantitatively, a computer program for 
which the data Is presented In Figure 3.4-5, has been developed by 
DAC. This program makes three assumptions about the couplers In 
the network: 


1. All couplers In a given network have Identical Insertion 
loss . 

2. The asymmetry of the couplers Is constant, regardless of 
the tap ratio. 

3. The efficiency of the couplers Is constant, regardless of 
the tap ratio. 


Our discussions with suppliers and lab tests to date Indicate that 
these assumptions are roughly true (+-15%) and adequately 
conservative for the typical tap ratios which will be used 
(10-20 dB). 

State-of-the-art multimode fiber optic couplers can be produced at 
any tap ratio between 3 and about 40 dB. In a multiterminal data 
bus there will be some optimum tap ratio such that sufficient 
energy Is tapped from the bus but not so much that energy Is 
depleted for terminals further down the bus. The optimum ratio Is 
a function of the number and efficiency of the couplers on a bus 
and the configuration utilization. 


Applied to a typical FBL system (25 terminals). Figure 3.4-5 shows 
the relationship between the maximum loss budget (loss between 
Terminal 1 and 25) and the tap ratio for a dual K configuration 
(Figure 3.4-6) with the characteristics noted In the figure. The 
graph Indicates the minimum loss Is 48 dB and will occur when a 
14 dB tap ratio Is specified. Figure 3.4-7 shows the loss profile 
of the dual K linear data bus which has the same characteristics 
as the bus of Figure 3.4-5 and utilizes the 14 dB optimum tap 
ratio. The discontinuities Indicate the five bus connector 
locations (each tap fiber has one connector also). Also Indicated 
In this figure Is a typical wrap around loss (Insertion loss 
between the transmitter and receiver of a given terminal) for this 
configuration. Two connectors are Included In the wrap around 
path. The Importance of wrap around will become apparent In a 
subsequent discussion of optical receiver limitations. 

Closely related to the previous network loss budget considerations 
are optical transmitter and receiver limitations. The transmitter 
and receiver must operate properly with both the minimum and 
maximum path losses of a given network. The critical requirements 
are the amount of optical power which can be launched Into the 
network from the transmitters, and the capability of the receivers 
to detect a wide range of optical power levels as a result of the 
varied path losses of the linear networks Indicated. 
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25 NODE LINEAR NETWORK LOSS CHARACTERISTICS 



OPTIMUM 
TAP RATIO IdBV 

MAXIMUM 
LOSS (dB) 

MINIMUM 
LOSS (dB) 

COMMENTS 

DUAL K WITH 
TWO BUS FIBERS 
(FIGURE 1) 

14 

48 

24 

COMPLETE INSTALLATION 
REQUIRES TWO NETWORKS 

DUAL K WITH 
ONE BUS FIBER 
(FIGURE 3) 

18 

57.5 

24 

MAX LOSS INCLUDES 
50 0.1 dB SPLICES ANO 
50 COUPLERS 

(TWO OF EACH PER TERMINAL) 

UNEAR LOOP 
(FIGURE 2) 

17 

675 

34 

MAX LOSS INCLUDES 
10 BUS CONNECTORS 
(5 ON EACH SIDE) 
AND 50 SPLICES 
(25 ON EACH SIDE) 

BROKEN 
LINEAR LOOP 
(FIGURE 4) 

17 

37 

12 



FIGURE 3.4-5 


Results of Calculations for Each Linear Configuration 
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25 TAPS. 50% EFFICIENT. ASYMMETRY - 4 dB. (5) 2 dB BUS CONNECTORS. 
(25) 01 dB SPLICES. (1) 2 dB CONNECTOR ON EACH TAP FIBER 



FIGURE 3.4-6 

Dual K Fiber Link Loss Vs. Tap Ratio 
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14 TAPS. SO% EFFICIENT, ASYMMETRY - 4 <38. (5) 2 OB BUS CONNECTORS. 
(25) 0.1 dB SPUCES, (1) 2 dB CONNECTOR ON EACH TAP FIBER 
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FIGURE 3.4-7 

Oual K Fiber Optic Link Loss Profile 
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3.4.1 Optical Data Bus (Continued) 

The launched power Is limited by the fiber core size and the type 
of optical source used. Candidate optical sources Include laser 
diodes Burrus LEDs, edge emitting LEDs, and superlumlnescent 
LEDs. Although the laser diode has the greatest launched power 
capability, the drive circuitry Is complex and must be temperature 
stabilized. Typically thermoelectric coolers, which have large 
power consumption, are used for temperature stabilization. The 
laser diode Is generally less reliable (10 6 h °urs compared to 
10? hours) and more costly ($500-$2,000 compared to $10-$300) 
than a Burrus or edge emitting LEDs and presents a safety hazard 
to the user. The superlumlnescent LED Is also less reliable and 
more costly, leaving the Burrus or edge emitter as the only 
practical alternatives for avionic data bus applications. T 
edge emitter, although more expensive than the Burrus LED 
( $200-$300 compared to $1 0-$l 00) generally couples more power Into 
a given fiber. The launched power Improvement Is generally more 
pronounced with smaller fiber core sizes (100 micrometers or less). 

The trade offs between edge emitting and Burrus LEDs are currently 
being considered at DAC In the development of an optica 
transceiver pair suitable for the ARINC 629 termlna avionics data 
bus. The best surface emitting LED found to date “J 11 couple 
0 dBm peak Into a 100 micrometer core fiber but costs $600. The 
receiver alternatives are more complex as Its sensitivity and 
dynamic range specifications are not only a function of the 
optical detector utilized (pin diode or avalanche photo diode) but 
also a function of the associated electronics, signal format and 
data rate. These design trade offs and alternatives will not be 
discussed here as there are various papers available which discuss 
these Issues In detail. 

A state-of-the-art receiver developed for a 2 megabits Per second 
(Mbps) Manchester II encoded multltransmltter data bus (ARINC 629) 
has a sensitivity of -42 dBm minimum and a dynamic range of 
20 dB. Assuming 0 dBm launched power these specifications fal 1 
short of that required for each of the linear networks discussed 
previously. One of the factors which limits the sensitivity of 
this particular receiver Is the fact that It must be DC coupled. 
This requirement Is a result of the fact that the ARINC 629 data 
stream has no preamble and operates In burst mode ( 1 .e. , there 
relatively long quiet periods between data transmissions). The DC 
coupled design extends the bandwidth and therefore the noise In 
the receiver limiting sensitivity. 

A general consideration for a FBL System Is a given terminal s 
capability to check Itself during transmission and also to detect 
the presence of a collision on the bus and respond accordingly. 

In order for a terminal to check Itself during transmission, It 
must be able to receive Its own data from the bus. Thus the wrap 
around loss as discussed previously must be accounted for when 
determining a receivers dynamic range requirements. This loss 
must be large enough such that a given terminal does not saturate 
Its own receiver when It Is transmitting. 
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3.4.1 


Optical Data Bus (Continued) 

This Is particularly Important In the dual K configuration where 
the wrap-around loss Is considerably less than the loss between 
two adjacent terminals. It seems tempting on the first look at 
this problem to temporarily "desensitize" a given terminals 
receiver when that terminal Is transmitting or simply disable the 
receiver during that terminal's transmission and provide the wrap 
around signal electronically within the terminal Itself. Although 
either approach Is feasible, each would defeat that terminal s 
ability to detect a collision during Its own transmission This 
would not be acceptable for a FBL application as fault tolerance 
would be compromised. Thus wrap around loss and the associated 
limitations are an additional shortfall of fiber optics, at least 
In the dual K network configuration. 


A third shortfall of fiber optic technology In aircraft 
applications Is a produclblllty Issue. The Installation of fiber 
networks, particularly In linear configurations will Involve 
several challenges. To Install fiber optic network harnesses with 
acceptable losses will require they be Installed with a minimum o 
connectors and splices Implying harnesses be produced In as few 
nieces as possible. This will require the capability to 
manufacture sections of linear harnesses with couplers In single 
pieces with accurate dimensions quickly and easily on the aircraft 
assembly line. Current technology requires an extremely labor 
Intensive process to produce couplers, terminations and splices 
and cannot be readily adapted to aircraft manufacturing 
environments. It Is our experience that chipping and cracking 
during these processes are not at all uncommon, even for the 
experienced technician. Any fiber damage during the harness 
development process will require rework and possibly additional 
splices to avoid compromising the harness dimensions. 

To address the link loss and some of the Installation Issues of 
fiber optic networks, DAC can utilize the "Fiber Optic Integration 
Interconnection System" which has been developed at DAC to offer a 
new way to cost effectively Incorporate fiber optics Into a 
Deduction aircraft and minimize connections. This concept 
Involves new Installation handling and protection techniques which 
are needed to ensure first-time quality and to minimize production 
and In-service costs of fiber optics. This approach Is based upon 
treating the entire aircraft as a single system. It has three 
major components: 


A Trunk Line: This Is a fiber optic cable assembly that runs 

the entire length of the aircraft and has breakouts at 
designated locations found within a given "zone". The trunk 
consists primarily of AT&T's 12 fiber ribbon cable and 
utilizes their multiple array connectors which connects all 
12 fibers of the ribbon simultaneously. 
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3.4.1 Optical Data Bus (Continued) 

B. Zone: Divides the aircraft Into Interconnection areas. These 

"zones 11 are determined from the production procedures which 
manufacturing utilizes to build and assemble the aircraft. 

C. Fiber Optic Integration Unit Is a Junction box used to branch 
the fiber optic cable from the "trunk line" to the end 
destination point (data bus terminal In this case) within a 
designated "zone". 

This Installation approach offers many advantages such as the 
optimization and standardization of engineering design, 
maintainability, consistent quality Installations, reduced parts 
damage, reduced rework and Increased production efficiency. A 
prototype has been successfully Installed In a MD-80 mockup. It 
was a simple Installation task to route the ribbon fiber through 
the entire length of the fuselage with no connectors. 

In order to take full advantage of this Installation concept, a 
local star configuration can be utilized. A FBL System would use 
three transmissive stars as shown In Figure 3.4-8, one In the 
avionics bay, one In wing root areas and one In the tall area. As 
shown In Figure 3.4-9, using 16 X 16 star couplers with an 
Insertion loss of 14+- 1.5 dB with three receive fibers on each 
star connected to three transmit fibers on each of the other two 
stars a thirty terminal network Is realized with a maximum and 
minimum loss of 39 and 22 dB, respectively, assuming each transmit 
and receive fiber has two connectors at 1.5+-0.5 dB each. This 
only leaves a 3 dB system margin, leaving little room for 
component variations or additional connectors. 

In addition to Improving the network loss profile previously 
described, the transceivers can be Improved to Increase the 
terminal count and system margin limitations. OAC Is currently 
Investigating a Frequency Shift Keyed (FSK) signal format approach 
Instead of the standard Manchester II signal. A transceiver 
manufacturer has realized an additional 10 db of dynamic range 
with this signal format. This Is reflected In specifications of 
an optical transceiver recently developed. To address the 
limitations of receiver sensitivity a preamble can be added to the 
data bus messages. This would require a modification to the 
ARINC 629 and MIL-STD-1 773 . Preliminary Investigations Indicate a 
5 to 10 dB Increase In receiver sensitivity can be realized. 
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MAX LOSS (TERMINAL 1 TO (11 30)) - 39 dB 
MIN LOSS (TERMINAL 1 TO (2 .10)) - 22 dB 


NODES 1 THRU 10 NOOES 11 THRU 20 NOOES 21 THRU 30 



AVIONICS BAY WING ROOT AREA TAIL AREA 

PS420-16-0S# 


FIGURE 3.4-8 

Terminal Local Transmissive Star Fly-By-Light Network 
Compatible With Fiber Optic Integration Interconnection System 
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FIGURE 3.4-9 

Link Loss Terminal 1 to N for Local Star 
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3.4.2 Optical Sensors 

Voluminous amounts of research and developmental work have been 
done In Investigating fiber optic sensors. Except for an on/off 
switch and a temperature sensor, however, not very many of these 
sensors are available as products. The reason for this Is that 
most of the effort has been concentrated on demonstrating new 
Ideas and configurations of fiber sensors rather than on their 
reliability over environmental conditions. As generally happens 
with a new technology, product availability depends largely on the 
economics of replacing the existing technology. Limitations of 
fiber optic sensors Include the dynamic range and the sensitivity 
to physical parameters other than the one being measured. 

There are a variety of physical mechanisms that have been adapted 
for use In sensors employing fiber optics, comprising a set of 
optical modulation principles appropriate for optic sensors. In 
each of these principles a sensing element mechanism modifies 
power generated by some optical source to convey Information about 
the sensed physical parameter. These optical modulation 
principles can be grouped Into five major categories: 
Interferometry, Time Division Multiplexing (TDM), Wavelength 
Multiplexing (WDM), Intensity Modulation (IM), and Optically 
Powered Sensors (OPS). 

Interferometric type fiber optic sensors are more susceptible to 
changes In physical conditions, such as temperature variation and 
mechanical shock, than the Intensity modulated type. However, 
these problems can be over come through proper Instrumentation. 

For example, the fiber optic gyro Is a Sagnac Interferometer, and 
It Is a highly sensitive rotation sensor. Honeywell has 
demonstrated building an Interferometric fiber optic gyro as a 
product for the Attitude Heading Reference Systems (AHRS). The 
Intrinsic or extrinsic IM type fiber optic sensors are based on 
simple optical principles and have some limitations. These 
Include optical component contamination problems for sensors, 
output Intensity normalization requirements to compensate for 
connector and other losses, and limited capability to multiplex 
the output signals from several sensors on to a standard data 
bus. TDM and WDM approaches have the disadvantage of complex 
encoding schemes, high Insertion losses, and non-uniform bit 
response. Since both of them are based on extrinsic IM, they have 
the problems of encoder and fiber ends' contamination. 

Fiber optic sensors to measure switch state, position, pressure, 
and other parameters have been demonstrated In the laboratory, but 
their use In harsh environments such as an aircraft Is very 
limited. The present status and what might be needed to put some 
of these fiber optic sensors in FBL systems are described In the 
following subsections. 


4788S 


3-51 



Fly-By-Light 

Technology Development Plan 


FINAL REPORT 
30 August 1990 


3. 4. 2.1 Proximity and Other On/Off Switches 

The push-button switch relies on reflections of optical power from 
a mirror which Is switched either Into or out of the reflecting 
position. Though good on/off ratios may be achievable, failure 
modes Include susceptibility to contamination of the optical 
components and reliability considerations associated with the 
mechanical switching mechanism. Hermetic sealing of these 
switches Is difficult. This problem can be solved by using some 
sort of magnetic coupling to the switching element. Fiber optic 
switches which would pass the aircraft specifications are seen as 
plausible for the near term. 

3. 4. 2. 2 Pressure Sensors 

Several fiber optic pressure sensors Including Interferometric and 
IM types have been proposed. Detection capability of these 
sensors are often limited by their sensitivity to temperature 
changes. In one IM type the pressure Induced displaces a small 
diaphragm which acts as a Fabry-perot cavity attached to an 
optical fiber. Pressure Is then measured as a function of the 
resultant modified optical spectrum. Temperature sensitivity Is 
minimized by using a small cavity and proper selection of 
materials . Polarization cross coupling In a properly aligned 
polarization maintaining fiber can be used as a pressure gauge. 
Realization of pressure sensors for the FBL system may occur In 
the range of 10 years or less. 

3. 4. 2. 3 Position Sensors 

Linear variable differential transformers (LVDTs) are the most 
commonly used electrical position sensors used In aircraft and 
have proven to be very reliable. Most of the fiber optic position 
sensors are based on the principle of Intensity modulation. The 
position on a "n" bit gray-coded encoder Is read with a read head, 
which provides digital pulses that are wavelength or time division 
multiplexed. Since the multiplexing needed for a 10 bit 
resolution Is complex, non-uniform bit response Is seen as a 
common occurrence. In a delay-line TDM sensor, the non-uniformity 
Is caused by a Imbalance of delay-line taps or by Imperfections In 
the optical apertures of the read head. In a WDM system, It can 
be caused by Intensity modulations In the spectrum source, or by 
the optical properties of the fibers, connectors, filters, etc. 

The other most common problem with fiber optic position sensors 
proposed In the past Is that since light leaves the fiber, 
contamination of optics can degrade their performance. 

The digital-optical time division multiplexed (TDM) method of 
position measurement has been demonstrated on the Advanced Digital 
Optical Control System (ADOCS) program and a second generation 
TDM sensor Is being developed under the Advanced Optical Position 
Transducers (AOPT) program. In this concept a 20 nanosecond 
optical Interrogation pulse Is split up Into 12 delay lines. A 
reflective grey code plate reflects bits of position Information 
back down the respective delay lines. 
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3. 4. 2. 3 


Position Sensors (Continued) 

Thus the Interrogation pulse Is split Into 12 on/off serial 
position bits at the receivers. Although simple In theory, 
difficulties arise In connector losses and reflections. High 
speed automatic gain control circuitry Is required to accurately 
read the serial data In the presence of bit Intermodulatlon from 
connector reflections and delays. 


Eldec Corporation Is In the process of developing a hybrid 
electrical/optical sensor concept termed "El-Optic". This family 
of sensors uses existing electrical sensors powered by either a 
battery or an optical power source supplied via optical fiber. 
Sensor data Is communicated by optical fiber. Two simple battery 
powered sensors are now In flight testing In scheduled commercial 
service. Optically powered sensors are In a research stage at 
Eldec. Issues Involved In the design of these sensors Include a 
lack of reliability data for batteries, mlcropowered circuit 
design, and reliability at elevated temperatures. Advantages 
Include EMI Immunity due to purely optical external connections 
and a wide choice of sending functions. 

A passive fiber sensor concept In development at Eldec Is cal led 
Time Delay Intensity Normalization (TDIN) . Based on the Intensity 
modulation sensor concept, an optical pulse Is split Into a 
reference delay arm and a sensing arm. Some sort of transduction 
technique transforms an environmental parameter Into a reflected 
optical power level. The resulting signal pulse and delayed 
reference pulse are compared at the detector. 


After suitable analog pulse averaging and normalization, 
accuracies approaching 0.25% (9 bits) have been demonstrated over 
a source power variation of 12 dB. Thus, the principal problem o 
analog Intensity-based sensors has been addressed, namely source 
Intensity and connection loss variation. Concepts for 
multiplexing have been presented. (Reference 5). 


TDIN Is essentially a transducer readout concept and Is separable 
from the actual transducer design. The transducers themselves are 
still In a research/development stage. Accuracies and ripples are 
on the order of 1%. Optimization Is still required. The main 
concern for position sensors, for example. Is sealing against 
environmental effects. Temperature sensors and pressure sensors 
have not yet been developed. 


Litton Is developing fiber sensor concepts based on the WDM 
approach. Existing designs for rotary and linear position, 
temperature and pressure sensing, are under development for 
aircraft propulsion system applications. Areas of technology 
advancement needed Include better fiber jacket temperature 
performance for microbending losses, high reliability detectors 
and circuitry for high temperature environments, and broad 
spectrum LEDs. 
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3. 4. 2. 3 Position Sensors (Continued) 

Fllghtworthy approaches for position sensing should Incorporate 
the following features: 

o Light must not leave the fiber 
o Multiplexing schemes must be kept simple 
o Must have the capability to seal the sensor hermetically 
o The Insertion loss of the sensor must be kept as low as 
possible through careful design 

Passive optical sensors have achieved fllghtworthy status In some 
cases, but cost, ruggedness and production engineering Issues 
still limit the applicability of these sensors In flight controls 
systems . 

3.4.3 Optically Powered Sensors 

Electrically passive optical sensors as previously described are 
Ideal for Immunity against EMI. However, an engineering penalty 
Is paid for such sensors. Without the benefit of reliable 
electronic signal processing at the sensor, the types of sensors 
that can fill this category are severely limited. For example, 
the cost and maintainability penalties paid on the ADOCS program, 
which used a passive optical displacement sensor, were significant. 

It Is conceivable that electrically passive fiber optic position 
sensors that would satisfy the FBL system specifications can be 
made available for second generation FBL commercial aircraft. For 
the near term, Honeywell Is Investigating optically powered 
sensors. In this concept, optical fiber provides EMI Immunity by 
electrically Isolating the existing electrical sensor completely 
and overcomes the disadvantages of the passive sensor by providing 
powerful electronic signal processing capability. 

What made this possible was a breakthrough In micropower circuit 
elements. Honeywell was able to reduce normal power requirements 
of I/O circuits and signal processing circuits to extremely low 
levels and achieve high yields In production. Honeywell Is thus 
able to take full advantage of reliable and rugged sensors that 
have been proven In the field on operational aircraft and simply 
replace the I/O circuitry with those that could perform the same 
function utilizing significantly less power. An optically powered 
throttle lever angle (TLA) RVDT for a full authority digital 
engine control system Is being developed for the Optical 
Propulsion Management Interface System (OPMIS) program and will be 
flight tested on the Advanced Transport Operating System 
(ATOPS) aircraft at NASA Langley. Honeywell Is evaluating the 
application of this technology to FBW aircraft and the extent of 
EME Immunity that Is achievable. A proximity switch based on the 
same technology has also been developed at Honeywell. 
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3.4.3 Optically Powered Sensors (Continued) 

Principle advantages of optical powered sensor (OPS) technology 

Include: 

A. Mature electronic technologies 

B. EMI Immunity and verifiability 

C. Established common Interface - multlplexlblllty 

3. 4. 3.1 OPS Technology Development Areas 

Optically powered sensor development centers around several key 

areas. These areas Include: 

o Temperature stabilization of sensor output, 
o EME-lmmune sensor module packaglng/shleldlng. 
o Optical source power and reliability, 
o Multiplexing architectures and protocol, 
o High temperature (250°C) circuitry. 

These areas will be discussed briefly below. 

A. Temperature stability Is completely Independent of optical 
effects In an optically powered sensor since the optics are 
used only as a digital Information and power channel. 
Electronics effects at the sensor alone determine the 
temperature stability. Considerable progress has been made In 
designing ratlometrlc calibrating micropower circuitry that to 
a first order cancels temperature drift In components. 
Circuitry for the TLA sensor provides less than 0.5% drift 
over the temperature range of -55°C to +90°C. 

Beyond this temperature, leakage currents from components such 
as diodes and CMOS gates become noticeable, requiring more 
optical power to maintain the electrical power budget. 

B. An Isolated electrical circuit can be shielded to an arbitrary 
level from EME at expected frequencies, l.e. to the GHz 
range. When a small aperture In the shielding Is opened for 
optical connections, short wavelength radiation In the 

GHz frequency range may be coupled to the optical photodiode 
or LED. Low frequency cutoffs of KHz and MHz on these devices 
will attenuate coupled microwave radiation to a large extent. 
Another EME coupling aperture may be provided by the 
electrical transducer Itself, such as RVDT, LVDT or 
temperature sensor. Further study and EME modeling Is needed 
to accurately determine the EME attenuation of the sensor 
shielding. It Is expected that the elimination of long 
electrical or sensor cabling will virtually eliminate EME 
coupling Into the OPS system. 
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3. 4. 3.1 OPS Technology Development Areas (Continued) 

C. High power, high reliability LED technology Is being actively 
pursued by Honeywell's Optoelectronic Division (OED) and 
Corporate Systems Development Center (CSDC). At OED, new 
lenslng techniques that Increase fiber-coupled power by up to 
a factor of six for 100m fiber are In development. At CSDC, a 
dielectric quarter wave stack acts as a mirror to reflect 
light towards the fiber, nearly doubling power output. These 
technology developments will drive the demonstrated high 
reliability of LED's to a sufficient power margin for most 
optically powered sensors. 

For longer term sensor technology development, sensor 
multiplexing and architecture Issues Indicate the use of laser 
diodes as optical power sources. Reliability and temperature 
Issues are presently hindering the acceptability of these 
devices. Lifetime enhancement by low duty cycle usage and 
near threshold operation are being Investigated by Honeywell. 
Thermoelectric cooler technology Is not yet reliable enough 
for application. Further development Is needed by the laser 
and thermoelectric cooler manufacturers. 

D. The development of high power optical sources will drive the 
multiplexing capabilities of optically powered sensors. 

Issues to be analyzed Include sensor architectures power 
margins, redundancy, and data communication protocols. It may 
be possible to Interface In this system to an ARINC 629 type 
of optical network. 

E. Operation over the range of -55 to +125°C Is expected with 
silicon-based technology. Longer term research will center on 
the use of slllcon-on-lnsulatlon (SOI), Gallium 

Arsenide (GaAs) , and Silicon Carbide (SIC) technology. Higher 
bandgaps In these semiconductors allow higher temperature 
operation with reduced leakage current. Honeywell Is active 
In both SOI and GaAs technology, and significant progress Is 
being made In SIC technology at companies such as Cray 
Research. 

3. 4. 3. 2 OPS Development In Industry 

The optically powered sensor concept Is also known as 
power-by-llght ( PBL) and power-by-fiber (PBF). EG&G and Slmmonds 
Precision also are developing OPS systems. Moog, Inc., with Banks 
Electronics and Varlon, has also developed a prototype OPS. 


4788S 


3-56 



Fly-By-Light 

Technology Development Plan 


FINAL REPORT 
30 August 1990 


3.4.4 Optical Gyro Technologies 

3. 4. 4.1 Overview 

Three types of technologies are currently being pursued for 
gyros: the Interferometric fiber optical gyroscope (IFOG), the 

resonant fiber optic gyroscope (RFOG), and the ring laser 
gyroscope ( RLG) . Currently, RLG's are widely used for many types 
of military and commercial applications, while the other 
technologies range from research and development to early product 
development. All three kinds are based on the Sagnac effect. 

This phenomena, discovered In 1913, states that two 
counter-rotating optical beams traveling around the same closed 
optical path will experience pathlength differences that are 
proportional to the rotation rate of the closed optical path. 

The various optical gyro technologies are distinguished by 
different techniques for measuring this rotation-induced 
pathlength difference. The RFOG and RLG pathlength differences 
are sensed by measuring the difference between two cavity resonant 
frequencies. In the IFOG, the rate Is sensed through direct 
measurement (open-loop) or the nulling (closed-loop) of the 
optical phase differences of the two beams. 

The means of Implementing the measurement of pathlength 
differences are quite different among the RLG, the IFOG and the 
RFOT. Both the IFOG and the RFOG utilize an external light source 
to launch light Into a passive fiber loop. The IFOG requires a 
broadband light source to eliminate many error sources while the 
RFOG, whose operation most closely resembles the RLG, requires an 
extremely narrowband light source. For the RLG, a narrowband gas 
laser with Its active gain medium Is an Integral part of the 
sensing cavity. Therefore, the RLG Is characterized as an 
"active" optical gyro, as opposed to the IFOG and RFOG which are 
considered passive. 

The fiber optic gyroscope of choice Is the IFOG because It can 
meet the aforementioned objectives while offering additional 
advantages. These Include low weight, low power consumption, 
rapid start-up time, long shelf life and flexible geometries. The 
advantages of the IFOG are attributed to Its solid-state 
construction and Its limited number of components, which are a 
light source, a coupler to split light, a length of optical fiber 
as the rotation sensing loop, a photodetector and a polarizer. 

IFOG ' s are potentially low In cost. 

As mentioned earlier, IFOG ' s are essentially classified as either 
open-loop or closed-loop. 
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3. 4. 4. 2 Open-Loop IFOG 

In the open-loop IFOG, light Is directed Into the fiber to sense 
the rotation rate. Upon exit, a photodetector captures the two 
counter-propagating beams having some relative phase shift. (If 
the gyro Is at rest, the two beams will travel the same distance 
and will be In phase, and the Intensity of the combined beam will 
be maximum.) Destructive Interference due to any phase mismatch, 
as a result of a rotating gyro, will result In a reduction of the 
output Intensity. The rotation rate can be determined by 
monitoring signal changes at the output. 

Despite Its presumed simplicity, the open-loop design Is a 
sophisticated Instrument requiring additional refinements. The 
output photocurrent, for example. Is a raised-cosine function of 
the phase difference between the two counter-propagating beams. 
Sinusoidal bias modulation Is Introduced at one end of the sensing 
loop by means of an optical phase modulator that Is used to 
overcome at-rest minimum sensitivity. Synchronous demodulation of 
the detected optical signal Is then applied to recover the 
rotation rate and direction of rotation. Such a modulation- 
demodulation technique transforms the gyro transfer function from 
that of a raised-cosine to a sine. The latter function exhibits 
maximum sensitivity at rest. The polarity of the signal Indicates 
the direction of rotation. 

Problems arising from the sinusoidal transfer function are 
twofold. First, the periodicity of the sinusoidal function yields 
an unambiguous measurement only between -90 and 90 degrees. Thus, 
the dynamic range Is limited. Secondly, the scale factor 
linearity becomes worse as rotation rates Increase. Achieving 
good scale factor performance over a large dynamic range Is an 
on-going research topic for the IFOG. 

Both dynamic range and scale factor linearity can be Improved with 
open-loop signal processing techniques and the use of a 
closed-loop servo. Open loop processing relies on post processing 
of the gyro output signal to linearize the sinusoidal dependence. 
The closed-loop servo, on the other hand, uses a feedback loop to 
force the gyro to operate at the null condition. Both techniques 
help minimize the dependence of the output on fluctuations of 
light source Intensity, which Is a sensitive design concern. Over 
the past 10 years, various open-loop processing approaches have 
been proposed. The success of these open-loop techniques have 
resulted In only modest gains In dynamic range and scale factor 
accuracy. The open-loop IFOG Is limited to low performance 
applications because of the limited dynamic range and a scale 
factor accuracy. 
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3. 4. 4. 3 


Closed-Loop IGO (Serrodyning) 

To achieve appreciably Improved performance, IFOGs are best 
operated In a closed-loop mode, the present focus of IFOG 
development. In a closed-loop IFOG, the Sagnac phase shift Is 
compensated by Introducing a phase shift of opposite polarity 
using optical components within the fiber loop. One of the 
preferred approaches for generating this phase nulling effect Is 
to apply an optical frequency shift at one end of the fiber using 
a technique known as serrodyne phase modulation. Serrodyne Phase 
modulation was first applied to microwave circuits to perform the 
function of a frequency shifter. "Serra" In Latin means saw or 
sawtooth. 


By placing a phase modulator at one end of the fiber sensing loop, 
and applying a sawtooth drive voltage to the modulator, clockwise 
and counterclockwise waves each experience a saw-tooth phase 
modulation but delay relative to each other by a time 1n Jerval 
equal to the loop's transit time. The effective Phase shift at 
the output of the loop Is equal to the net phase difference of the 
two sawtooth waveforms. Consequently, there Is nonreciprocal 
phase shift that Is then used to counterbalance the 
rotation-induced Sagnac phase shift. With this scheme, the sensor 
Is always operated at Its most sensitive null condition. The 
dynamic range of the serrodyne closed-loop IFOG will only be 
limited by the bandwidth of the loop-closure transducer and the 
serrodyning electronics that return the sensor to Its null 
position. 


In practical Implementations, the output of the synchronous 
demodulator Is used as the error signal of a closed-loop servo. 
This signal, after Integration and amplification. Is used to 
control the frequency of the serrodyne electronics that drive the 
phase modulator. The amount of phase shift applied to the sensing 
loop Is proportional to the serrodyne frequency which Is a 
measurement of rotation rate. 


The null operation of closed-loop IFOGs also removes the problem 
of source power fluctuation and electronic gain Instability. e 
digital readout electronics of the serrodyne IFOG generate a pulse 
at the falling edge of each sawtooth cycle. Each pulse 
corresponds to a small, fixed angular rotation and thus this 
device Integrates the rotation rate. 

The two required elements for a high performance closed-loop IFOG 
are a high speed serrodyne driver, and a high quality serrodyne 
phase-modulator. 
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3. 4. 4. 4 IFOG Highlights 

A. Open-loop IFOG 

1. First FOG to be Introduced as a product 

2. Low-medium scale-factor-performance applications 

o Aircraft attitude, heading, and reference (AHRs) 
o Space applications with modest scale factor 
requirements 

3. AHRs flight test scheduled for latter 1989, 1990 

4. Production to begin by 1991 

5. Technical Data 

o Sinusoidal output limits dynamic range to ±90° 
optical phase shift 

o Scale factor linearities of 1000 ppm over 
temperature demonstrated 

o AHRs IFOG bias stability of l°/hr, random noise 

0.004°/sq. rt. (hr) demonstrated 
o Higher performance open-loop gyro have 

demonstrated 0.1°/hr and 0.004°/sq. rt. (hr) bias 
stability and random noise performance, 
respectively 

B. Serrodynlng IFOG 

1 . Closed-loop IFOG 

2. High-performance applications 

o Commercial airliners 
o Military aircraft 

3. On-going prototype efforts 

4. High-speed serrodyne driver 

5. High-quality serrodyne phase-modulator 

6. Technical Data (ten-hour prototype run) 

o Scale factor linearity Is 30 ppm from - 199 deg/s 
to 100 degs/s 

o Bias stability 0.02 deg/hr 
o Random noise of 0.0016 deg/sq. rt. (hr) 
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3. 4. 4. 4 IFOG Highlights (Continued) 

o Scale factor repeatability Is better than 5 ppm at 
room temperature, and better than 15 ppm from 
-55°C to +45°C 

o Optical phase shift stability of 0.4 microradians 
7. Forecasted flight test - two (2) years 

3.4.4. 5 Necessary Developments to Enable FOG 

In order for the fiber optic gyroscope (closed-loop configuration) 
to become fully operational and a prevalent product In commercial 
and military aircraft markets, the following systems, 
technological, and cost Issues will have to be resolved. The 
Issues or concerns Included In this document do not enumerate all 
the problems associated with this project; however It does provide 
details as to the developments required to enable this technology 
for application In commercial avionics. Background Information 
about optical gyroscopes and specific fiber optics gyroscopes was 
Included to familiarize the reader with current technology and as 
explanatory data. 

A. Technology Issues 

1. Wavelength stabilization of the light source to ensure 
long term scale factor repeatability. 

o Accurate measurement of the wavelength 
o Temperature control/measurement compensation over 
wide environments 

2. Testing over environments 

o Thermal transient gradients across the sensing coll 
o Radiation hardening 
o Shock and vibration 

3. Light source lifetime 

4. Electronic development 

B. Cost Issues 

1. Fiber - reduce fiber costs 

2. Components - current costs expected to go down rapidly 
with large production volumes 

3. Manufacturing and Production - unknowns 

4. Factory Capital Costs - simple factory expected to be an 
advantage for FOGs 
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3.4.5 Some systems that have flown 

There have been many fiber optic system flight test programs since 
the late 1970's. A variety of data links and a few optical sensor 
systems have been reported. Most of the optical systems generally 
performed up to expectations, although after extensive production 
engineering for difficulties, especially with sensors. Problems 
common to all systems centered on the Interconnection hardware. 

The following are among the notable systems to date: 

A. AV-8B Harrier Digital Data Link 

B. ADOCS JUH-60A Digital Flight control side-arm controllers 
position transducers 

C. DC-10 Aileron Position - Sensor, Passenger Entertainment System 

D. 737-200 - Nose gear downlock sensor 

E. Boeing 8X8 Star Bus Ethernet Command/Control 

In general, connection hardware was the main problem on these 
flight tests. Douglas Aircraft has conducted an extensive 
connector evaluation program and has specific recommendations and 
technology plans for solving these problems. 

3.4. 5.1 OPMIS 

As part of Its Fiber Optics Readiness program, Douglas Aircraft Is 
currently evaluating optical propulsion system technology In Its 
Optical Propulsion Management Interface System (OPMIS) program. 

This Is a cooperative program between DAC, United Technologies, 
several fiber optic sensors vendors, and NASA Langley Research 
Center. NASA Is providing flight testing for vendor-supplied 
fiber optic engine sensors and throttle sensors. This Is an 
opportunity for these vendors to gain valuable flight test data on 
their optical components starting In 1990. 

3. 4. 5. 2 ADOCS 

Production and flight testing of the first fiber-optic position 
transducers revealed many of the problems of production and 
reliability of electrically passive fiber sensors. Teledyne-Ryan 
provided a set of TDM fiber sensors for the Advanced Digital 
Optical Control System (ADOCS) program, based at the Army Applied 
Technology Laboratory In Fort Huestls, VA. 
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3. 4. 5. 2 ADOCS (Continued) 

Displacement transducers were designed to measure the position of 
the helicopter swash plate and hence the main rotor angle. Short 
stroke transducers were designed with 8 bits of precision, and 
long stroke transducers with 12 bits of precision. Some 30 of 
these sensors have logged over 500 hours of helicopter flight time 
on the JUH-60 "Light Hawk". Some of the main technology 
development problems faced for these transducers were as follows: 

A. Special 50m fiber delay line coll technology, with thermally 
matched mandrel and fiber. 

B. Transducer sealing against "plstonlng" effect In a highly 
contaminated environment. 

C. High power pulsed laser diodes. 

D. Extensive multiplexing, both on the bit level and on the 
sensor level. 

E. High frequency automatic gain control electronics required for 
non-uniform bit response. 

F. Optical code plate thermal expansion over the -65°F to 165°C 
environment. 

G. Low power budget margin. 

H. Connector technology In a severe vibration environment. Fiber 
breakage and connector contamination remains a problem. 

The tremendous amount of engineering Involved to overcome these 
problems resulted In a price tag of $25,000 apiece for these 
transducers. The system Included 24 transducers. A second 
generation of Teledyne-Ryan ' s TDM sensor Is being developed under 
the Advanced Optical Position Transducer (A0PT) program. It Is 
evident from this program that the simple, elegant theoretical 
Idea of TDM sensors Is very difficult to Implement In a production 
engineering sense. 

3. 4. 5. 3 F0CSI 

The Fiber Optic Control System Integration (F0CSI) program has 
concentrated on military applications of FBL FCSs. 

3.5 FBW/FBL System Functions 

The necessary functionality for commercial transport FBW/FBL Is 
generally agreed. In addition to augmented pltch/roll/yaw 
control, full aircraft flight envelope protection Is necessary. 
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3.5 FBW/FBL System Functions (Continued) 

Autoland is generally not considered to be a part of FBW/FBL. 


3.6 


Sldestlck control Is likely to be of the rate-command/attitude 
hold type, or an equivalent. 


FBW/FBL Computer to Sldestlck Interface 


The technology drivers for sldestlck controllers (SSC) Indicate 
that a fly-by-1 Ight ( FBL) configuration Is desirable. 

Fly-by-wire ( FBW) SSCs have used electrical transducers to detect 
the motion of gimbals having mechanical mechanisms which provide 
'feel' characteristics Illustrated In Figure 3.6-1. The 
controller always exhibits a return-to-center characteristic. The 
force versus displacement characteristics are characterized by: 


o Break-out force 
o Primary force gradient 
o Softstop stop 
o Hardstop magnitude 


The breakout force provides the pilot with a definite Input force 
threshold before manual control Is applied. The softstop step 
provides a definite cue to the pilot about the limit of- the flight 
regime. The softstop step can also be used to Implement different 
control laws with the force gradient change, providing a cue to 
the pilot. 

Mechanization of conventional FBW aircraft SSC for roll and pitch 
Incorporates a base pivot In such a way that the grip pivots about 
a point below the forearm, providing both force and displacement 
to the pilot. Conventional force gradients are achieved by a 
spring/scissors mechanism allowing complete adjustability during 
build. Viscous damping provides the best feel for aircraft SSCs. 
The mechanisms Incorporate a balanced pitch glmbal that prevents 
Inputs due to longitudinal aircraft acceleration. 


Left and right hand grip configurations are provided. The switch 
functions provided on each grip are tailored for each cockpit 
configuration. Human factors specialists determine proper 
location and force magnitude, optimized for ease of actuation. 


Assemblies under mechanical loading where stress considerations 
relate to safety hazards are: 


o Column 

o Pitch and roll gimbals 
o Housing 
o Boots 
o Springs 

o Rolls and pitch damper linkages 
o Interconnect cabling flexing. 
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FIGURE 3.6-1 

Interactions of Force and Displacement, and Other Elements 
That Enter Into Hand Controller Design Considerations 


4789S 


3-65 



Fly-By-Light 

Technology Development Flan 


FINAL REPORT 
30 August 1990 


3.6 FBW/FBL Computer to Sldestlck Interface (Continued) 

Assemblies where mechanical wear- out-mechanisms come Into play are 
o Microswitches 

o Roll and pitch glmbal bearings 
o Damper seal mechanism 
o Roll and pitch RVDTs 
o External connectors 
o Roll and pitch scissors mechanism. 

These are typical parts for an SSC. 

3.6.1 Active SSC 

Lack of cross-cockpit coupling between SSC using conventional 
FBW mechanical design may be overcome by active hand controller 
technologies. Active SSCs use gimbals that are motor driven 
rather than spring-restrained. The motors are actively controlled 
by the flight control computer; thus, the two SSCs In the cockpit 
will be electromechanical ly coupled. Forces exerted In opposite 
directions will be algebraically added, with the net force 
resulting In movement of the SSC. 

Motor driven hand controllers are operational In our lab and 
utilize the following components: 

o Brushless dc torque motors 
o Sinusoidal motor commutator 

o Rotational variable differential transformers (RVDT) or 
digital encoder pick-off 
o Planetary gear reducers 
o Internal torque sensors. 

The hand controllers require real-time computer control where 
position, rate, and force Is output by the SSC and force command 
Is received. The flight control computer will provide the 
processing capacity, performing the control algorithms for the 
pilot and copilot SSCs. 

The technologies for active SSCs are available without research 
breakthrough. Areas such as high torque/low weight brushless 
dc torque motors, available because of the new rare earth 
permanent magnets coupled with relatively easy computation power 
provided by microcomputers, makes active SSCs feasible. 
Engineering Implementation Is the most significant factor to 
consider the following critical commercial transport Items: 

o Safety 
o Reliability 
o Weight 
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3.6.1 Active SSC (Continued) 

An FBL version of an active SSC requires optical data to be 
transmitted between the SSC and flight control computer 
(Figure 3.6-2). Since an active SSC uses Internal electrical 
signals, an optlcal-to-electrlcal converter Is required. 

3.6.2 SSC Sensors 

SSCs for use In an FBL flight control system must provide an 
optical output signal to the flight control computer. For 
near-term applications, the output from an FBL SSC will be a 
direct optical link to the flight control computer. As sensor 
technology and optical data bus architecture mature, SSCs will 
Incorporate multiple axis sensors that Interface both Input and 
output to a single optical fiber. The need for more than one 
fiber will result from safety (redundancy) requirements rather 
than data transmission needs. In the medlum-to-long, SSCs will 
Interface with flight control computers through a standard 
avionics optical data bus. 

3. 6. 2.1 Preliminary Analysis and Trades 

For Initial analysis of human factors, the side sticks for air 
transport FBL systems will employ standard electronic sensors with 
the output converted to light by the use of a transmitter. 
Coincident with human factors design, all position sensors used In 
the FBL system will be reviewed for applicability to side stick 
controls . 

The paragraphs below outline several options which exist for 
suitable sensors. Including: 

o Analog electrical sensors with output converted to 

optical. These sensors require electric Input and provide 
a voltage output dependent on the magnitude of the stick 
displacement. 

o Digital electronic sensors with output converted to 

optical. These sensors require electric Input and output a 
digital position signal to the flight control computer. 

o Digital optical sensors with or without multiplexed light 
output. These sensors are passive since no electric power 
(only light) Is required for Input and output. 
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OPTICAL INPUTS FROM FCC 


OPTICAL INPUTS TO FCC 
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Optical Interface of Sidestick with Flight Control Computer 


FIGURE 3.6-2 

Optical Interface of Sidestick with Flight Control Computer 
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3. 6. 2. 2 Analog Electrical Sensors 

Analog sensors such as RVDTs have been used as position sensors 
for many years in flight control systems. They are essentially 
transformers with a primary coll that couples two secondary colls 
through a movable core. As the core Is moved, a larger signal Is 
coupled Into the secondary. The direction of motion Is determined 
by the phase of the output signal. Triple or quad redundancy Is 
currently available. Other analog sensors are available such as 
resolvers and synchros. 

Demodulation circuitry Is available to convert an RVDT output to a 
digital signal. The digital signal can then be converted to a 
digital optical output signal. However, the side stick unit will 
require electric power to perform the conversion. 

3. 6. 2. 3 Digital Electronic Sensors 

A second type of position sensor that has been used for side stick 
control applications Is an absolute shaft angle encoder. This 
device consists of LEDs and phototransistors separated by a code 
wheel. The wheel Is a metal disk etched with an array of precise 
holes. As the code wheel turns, the phototransistors will provide 
a digital output signal that depends on shaft position. Although 
encoders can be made with 1 6— b 1 1 accuracy, hand controllers 
require 12-bit accuracy. This type of sensor has several 
advantages: (1) no moving electrical contacts, (2) the device 

uses long life electronics, (3) the signal generated by the code 
wheel Is digital and doesn't require A-to-D conversion. The 
disadvantage of encoders Is that they are single-redundant; thus, 
multiple sensors must be used to accomplish redundancy. 

3. 6. 2. 4 Digital Optical Sensors 

The digital electronic output from any of the above devices may be 
converted to light and Injected Into a fiber link using existing 
transmitter/receiver circuitry. However, these devices require 
electrical excitation and output digital electrical data. Optical 
sensors, on the other hand, are passive since no electric power 
(only light) Is required for Input and output. 

For the short term, a small rugged optical sensor Is available 
from Litton Encoder. This sensor employs encoder technology as 
described above; however, light originates from LEDs located 
outboard of the sensor (e.g.. In the flight control computer) and 
Is delivered to the sensor via fiber optic (F/0) bundles. The 
encoded position of the shaft angle Is then delivered to the 
flight control computer via F/0 bundles. These sensors offer 
several advantages: (1) sensors are smaller than electronic 

encoders, (2) F/0 bundles will still function even If some fibers 
break, and (3) the output of the control unit Is available as 
0-10 Vdc, as well as digital, thus providing dissimilar 
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3. 6. 2. 4 Digital Optical Sensors (Continued) 

redundancy. This type of sensor may be Incorporated Into an 
existing design Immediately. The disadvantage of this sensor Is 
that dedicated links are required for optical transmission and 
that the parallel 'word' output requires several transmission 
channel s . 

For the medium term (three years), single fiber encoders may be 
available. These sensors provide light Input and output on a 
single fiber. In addition, the Input/output of both the pitch and 
roll axis may be placed on a single fiber using a splitter. Two 
types of single fiber sensors are today available as prototypes. 

TDM sensors were developed under the ADOCS program by 
Teledyne-Ryan, and WDM encoders have been developed by 
Lltton-PolySclentlflc. The output of these sensors will be fed 
directly to the flight control computer through a fiber optic link. 

Long term sensors will be similar to those Identified for medium 
term except that their output will be Interfaced to an optical 
avionics bus. 

3.6.3 Human Factors 

3. 6. 3.1 Handling 

The force per displacement and force per aircraft response 
characteristics have been researched In previous studies, but 
additional work remains to obtain the optimal levels for both 
these characteristics. Figure 3.6-1 Illustrates the relationship 
of the various sldestlck controller force per displacement 
characteristics that will be determined. The tactile feedback for 
the pilot to sense the neutral point Is achieved with a breakout 
force. A softstop position will be Included In the sldestlck 
controller design and the force and displacement limits will be 
experimentally determined. The location of the sldestlck 
controller X-Y axes should be rotated Inboard and forward to 
minimize cross-coupling between the pitch and roll axes. If force 
feedback Is to be Included In the sldestlck controller (forces 
from either the other pilot or the autopilot), the time delay of 
pilots Input forces to the actuator movement should be 100 ms to 
maintain pilot-system stability. 

These Issues will be thoroughly reviewed In the available 
literature. Especially relevant are those studies conducted by 
Airbus, Boeing, and DAC. Unresolved Issues will be Initially 
evaluated In the laboratory and later moving to a high fidelity 
simulator and then to flight test for final calibration. 

3. 6. 3. 2 Human Interface 

The Increasing number of female pilots In the airline Industry 
Impacts future hand controller configurations. The anthropometlc 
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3. 6. 3. 2 Human Interface (Continued) 

Implications of the grip design and the adjustability of the grip 
position with respect to the seat reference point will need to be 
addressed . 

If force feedback Is to be Incorporated In the design, male and 
female strength capabilities must be considered during the 
selection of human Interface parameters. 

Human factor specialists are utilized In the proper selection and 
location of gyro mounted switches to Insure ease of activation 
without cross coupling to SSC motion. 

3.7 FBW/FBL Computer to Actuator Interface 

The application of smart actuators to commercial transport 
aircraft Is without production precedent. It Is anticipated that 
"smart" actuators which contain processors that perform most or 
all of their own monitoring would be used for a FBW/FBL System. 
This simplifies the Interface since they need only be connected to 
a common bidirectional data bus. 

However, the aircraft Is now potentially vulnerable to a generic 
CPU or software fault. Relative to this concern, DAC/HI have been 
actively evaluating a concept referred to as smart-actuator- 
override. The actuator's processor/software could be bypassed by 
the flight control computers and forced either to engage 
unconditionally or disengage. Accordingly generic fault 
protection could be provided for the smart actuator by the flight 
control computer. 

3.8 System Availability 

The use of redundancy to extend the average Interval of time 
between required maintenance actions Is of particular Importance 
for FBL. The mechanical systems being replaced by electronics are 
themselves seldom replaced. It can be argued that to avoid 
uncertainties and risks associated with comparatively frequent 
equipment replacements, that the unit removal frequency for an FBL 
System must be In the same range as the mechanical assemblies 
being replaced. 

The redundant elements which act In effect as "spares" have come 
to be referred to as "secondary redundancy". Redundancy of the 
more traditional type Is by contrast referred to a "primary 
redundancy". The failure of an element of "secondary redundancy" 
results In no loss of functionality or reduction In safety level. 
The mean-tlme-between-unlt- removal (MTBUR) that Is believed 
necessary Is In the range of 100,000 hours. It should be noted 
that such an extension of availability worsens the problem of 
fault latency. Accordingly faults can be sustained without unit 
removal despite Internal "self-repaired" faults. 


4789S 


3-71 



Fly-By-Light 

Technology Development Plan 


FINAL REPORT 
30 August 1990 


3.9 


3.10 


3.11 
3.11 .1 


4789S 


System Availability (Continued) 

The suggested task(s) to be performed address the benefits, 
problems and, of course, costs associated with the Incorporation 
of "secondary redundancy" for extended availability. 

Candidates must be developed and compared. The Impact on 
maintenance practices and Installation mechanisms must be 
addressed . 

Two ways of controlling reconfiguration of secondary redundancy 
elements should be each Investigated. Reconfiguration decisions 
can be made by hardware voters or via software comparisons and 
decision making algorithms or a combination of these methods. 

Graceful Degradation 

In Section 3.3, normal functionality was defined as requiring 
augmented flight and automatic attitude hold. There Is a need to 
explore methods such that the system performance will 
Incrementally degrade as sensor sets are lost, rather than 
shutdown, as Is the predominant approach In current flight control 
systems . 

Generic Fault Tolerance 

At the current time, N-verslon techniques are being applied by 
most airframe manufacturers and avionic suppliers to provide 
limited protection from certain types of generic faults. If this 
Is to continue, we need to specify design guidelines to maximize 
version Independence. A survey of experiences with N-verslon 
techniques Is needed to aid In providing a quantification of 
benefit. 

System Recovery from Upset (Soft Fault Tolerance) 

Introduction 

Dependence upon electronic equipment to provide functions that are 
critical to the safe flight and landing of aircraft, Is one of the 
most profound of the recent advances In avionics. The conversion 
of analog systems to a digital counter part Is a natural extension 
of this continuing evolution In avionics. Because of the Immense 
emphasis on research and development for the advancement of the 
electronic devices associated with digital processors and the 
extraordinary advancements that have been achieved as a result of 
this emphasis, digital processing provides the opportunity for a 
vast expansion of the role of electronics In the control and 
guidance of aircraft. 

However, along with their data processing power, digital 
processors have unique considerations that must be taken Into 
account. Digital processors are extremely complex general purpose 
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3.11.1 Introduction (Continued) 

machines. The complex software and hardware defy deterministic 
assessment methodologies, thus, digital processor behavior should 
be viewed as a probabilistic Issue. Soft faults refer to a 
probabilistic characteristic of digital processors that Is not 
found In analog processors and Is, therefore, a relatively 
unrecognized, unknown and unfamiliar factor. The more familiar 
and commonly recognized failure characteristic Is referred to as a 
hard fault where an electronic device has failed In a permanent or 
Irreversible fashion and Is noncorrectlble (l.e., the device has 
been destroyed and the needed operational characteristic 
permanently lost). Hard faults are a characteristic that Is 
common to both digital and analog processors. 

Unlike hard faults, soft faults can be corrected by correcting the 
state of the logic circuits (program counters, registers, etc.) 
that govern the control of the digital processor. When a soft 
fault occurs a digital processor may not recover to a proper 
operational state and may require some form of external 
Intervention to resume normal operation. Quite often this 
Intervention consists of recycling power to the digital 
processor. When power Is recycled, the control circuits are 
automatically reset to legitimate states. Soft faults have been 
Identified by several aliases (digital computer disruption, 
circuit upset, transient faults, correctable faults, single event 
upsets, faults with nonstationary observability, etc.). They are 
known to occur even when the operating environment Is relatively 
benign and despite the substantial design measures (timing 
margins, transmission line Interconnects, ground and power planes, 
and clock enables of digital circuits) taken to achieve a 
relatively high degree of Integrity In digital processor 
operation. However, their occurrence, which Is relatively 
Infrequent and random, can be Induced by any or all of the 
following factors: 

1. environment (electromagnetic, nuclear, etc.), 

2. Hardware (timing margins, circuit layout, etc.), 

3. Software. 

Soft faults may be the limiting factor In achieving Improved 
reliability In the next generation of avionics. In-service 
experience with digital systems Indicates that the confirmed 
failure rates are better than the predicted values which. In turn, 
are significantly better than previous analog equipment. However, 
the unscheduled removal rate remains about the same. There are 
several possible causes for this. A leading candidate Is soft 
faults, which cause the system to fall and result In a flight crew 
write-up, are no longer present when the line or shop tests are 
performed on the suspected unit. Airline anecdotal data Indicates 
many Instances of "BITE check OK and returned to service". 
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3.11.2 System Architecture Measures for Recovery 

Until recently, soft fault In digital avionics were manually 
corrected. More recently, the viability of systems level 
measures for the automatic correction of soft faults has begun to 
be Investigated. It Is perceived that significant benefits can be 
gained through soft fault protection measures designed Into the 
basic system mechanization. System-level soft fault protection 
methodologies provide the ability to tolerate disruption of either 
Input/output data or Internal computation. Accordingly, there are 
two distinct classes of disruption: 

1. Disruption at the subsystem Interface boundary causing 
corruption of data flowing to or from the affected 
subsystem. 

2. Disruption which reaches within the subsystem to corrupt 
Internal data and computation. As a worst-case scenario, 
It must be presumed that all memory elements within the 
computation system are affected at the time of disruption. 

The short term disruption of Input/output data at a system 
boundary can be managed via a variety of existing methodologies. 
Data errors must be detected and the associated data suppressed 
until the error status Is cleared. The data processing algorithm 
should tolerate data loss without signaling a hard fault. The 
length of time that can be tolerated between valid refreshes Is 
dependent upon the data Item and the associated time constants 
(response) of the subsystem. 

The ability to tolerate disruption which reaches computation and 
memory elements Internal to the subsystem, without propagation of 
the associated fault effect, Is a more difficult problem. For 
systems with redundant channels, this means toleration of the 
disruption without loss of any of the redundant channels. Fault 
clearing must be "transparent" relative to functional operation 
and cockpit effect. Hence, the term "transparent recovery". 

Transparent recovery requires that the disruption be detected and 
the system to be restored. Safety critical systems are almost 
always mechanized with redundant channels. Outputs of channels 
are compared In real time, and an errant channel Is blocked from 
propagating a fault effect. One means available for 
safety-critical systems to detect disruption Is the same 
cross-channel monitor. If a mlscompare between channels occurs, a 
recovery Is attempted. For a hard fault, the mlscompare condition 
will not have been remedied by the recovery attempt. 
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3.11.3 Transparent Recovery 

There are two basic approaches to transparent recovery. These are: 

1. State variable data are transmitted from valid channels 
to the channel which has been determined faulted and for 
which a recovery Is to be attempted (Figure 3.11-1). 

2. A valid set of state variables Is stored away prior to 
the disruption In memory which Is protected from the 
effects of disruption to a level far greater than the 
rest of the subsystem (Figure 3.11-2). 

The cross-channel mechanization Is Ineffective against a 
disruption which has the potential to affect all channels. 
Accordingly, the In-channel methodology has been emphasized In 
transparent recovery development activities. 

Ideally, the goal of the system designer Is to provide a means to 
tolerate the disruption without propagating the effects outside 
the subsystem. Stated In a different way, the goal Is to provide 
a means such that disruption can be tolerated without causing a 
"cockpit effect". It follows that for this to be possible the 
duration of the disruption must be short relative to the time 
response of the system, and mechanisms Instituted to achieve 
toleration of disruption must be capable of. In effect, clearing a 
fault caused by the disruption rapidly relative to the time 
response of the affected system. 

The qualification relative to duration of disruption Is reasonable 
when dealing with a safety-critical system. For such a system, 
the probability which must be guaranteed relative to total system 
disruption Is typically extremely small. In some cases, less than 
a 10-Vhr probability of disruption (of a safety-critical 
system) must be guaranteed. As a result, system level 
Implementations which provide a means to tolerate a disruption 
without propagation of an Induced fault outside the affected 
subsystem are perceived (for safety-critical systems) to be 
necessary. Without such mechanisms for commercial aircraft, 
physical protection (and Its maintenance) against EME which has 
been designed Into the subsystem, can become a potential 
"single-point fault". 

Because the occurrence of soft faults as an Inherent feature of 
digital processors should be acknowledged and accounted for, new 
hardware elements are proposed for processor architectures that 
would enhance traditional design practices to achieve an 
extraordinary degree of processing Integrity for the digital 
processor. These new functional elements would provide the 
detection of processing anomalies (upsets/soft faults), a 
protected region for the preservation of state data (logic and 
control), and the management of "transparent recovery" of data 
processing. 
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ia) FIGURE 3.11-1 

Cross-Lane Recovery 



In-Lane Recovery 
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3.11.3 Transparent Recovery (Continued) 

Detection of processing anomalies, protected storage of state 
variable, and recovery of correct processing are additional 
capacities needed to achieve the resulting Increased processing 
Integrity that Is associated with and achieved by transparent 
recovery. Figures 3.11-3 and 3.11-4 are diagrams of a digital 
processor architecture with transparent recovery elements. 

The detection of processing anomalies might be accomplished 
through a variety of measures. The most desirable measures would 
be those that are Inherent In the characteristics of processor 
operation. Essentially, these measures would probably amount to 
various types of reasonableness tests and could be In-line or 
cross-processor detectors or a combination of both. In addition 
to rough checks on data reasonableness, primarily, In-line 
detectors would check the reasonableness of processor behavior. 

For example, measures for concurrent In-line monitoring could 
correspond to checks of operational features of system 
performance. Concurrent monitoring techniques have been studied 
which can be Implemented In the form of a separate hardware device 
that operates In parallel with, and transparently to, the system. 

A key aspect of the monitoring process Is that Its Implementation, 
whatever form It may take, should be relatively simple when 
compared with the complex system being monitored. In other words, 
the process Is not meant to duplicate the performance of the 
system. 

The In-line monitoring process would record signals from a set of 
observation lines In the system to capture a data block and then 
analyze this block of data to determine whether the system Is 
upset. The process Is assumed to be dedicated; hence, Its 
two-phase function of first capturing and then analyzing a block 
of data will be repeated continuously while the system executes 
Its application program. For specific equipment the effectiveness 
of an In-line detector could be further enhanced by taking Into 
account salient characteristics of the executing software 
(e.g., program flow, constraints on data storage) associated with 
that equipment. 

Cross-lane monitoring becomes an option that naturally follows 
from the redundancy associated with fault tolerant data processing 
architectures. Cross-lane monitoring Is an additional 
complementary option to In-lane monitoring. Fault tolerant 
architectures are absolutely necessary when flight critical 
functions (e.g., FBW flight controls) are provided by 
electrical/electronic equipment. If the system architecture 
consists of additional redundant processors (one or more 
additional processors performing the same tasks), then 
cross-processor detectors could be used to provide additional 
coverage of processor upset. Data reasonableness would 
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FIGURE 3.11-3 

Digital Processor With Elements for Transparent Recovery 
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FIGURE 3.11-4 

Transparent Recovery Upset Detection and Recovery Flow 
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3.11.3 Transparent Recovery (Continued) 

be the primary parameter to be monitored by a cross-processor 
detector. This detector would complement the In-line detector by 
applying much finer criteria to corresponding data. As with 
In-line monitors (relative to the complex processors It Is 
monitoring), a cross-processor monitor should be a simple hardware 
device. 

Dynamic data are continually read from a storage region, updated 
by the digital processor, and then written back Into the storage 
region. A certain portion of that data contains Information that 
has been developed over time by the processing activity and Is not 
reproducible. This type of data Is referred to as state data. 

The set of state data along with the set of sensor data 
establishes the system state at each Instant of time. In the 
event of a temporary disruption of the digital processor, the 
state and sensor data can be used to quickly recover the 
processing activity In a relatively transparent manner. 

Thus, from a macro time perspective, system functions will 
continue to be performed, even though on a micro time basis a soft 
fault occurred. The key to transparent recovery Is the 
availability of state data. To guarantee the availability of the 
needed dynamic data, a protected storage region must be provided. 
Isolation from the energy of a potentially disruptive 
electromagnetic event or the use of storage devices that would not 
be permanently changed by the energy In such an event, are two 
general approaches to achieving a protected storage region. 

When a soft fault has been detected, high-level supervisory 
override hardware elements would cycle the digital processor 
through the recovery process. Basically, this process would 
Involve reinitialization of the system state using the data from 
the protected storage region, resetting the program counter to an 
appropriate address to restart program execution, and then 
restarting program execution. Another function of the supervisory 
hardware would be to keep track of the number of restart attempts 
within the appropriate period of time. If the number attempts 
exceeds the appropriate criteria, a noncorrectlble condition 
(e.g., hard fault) has to be presumed to have occurred. In that 
case, the supervisory electronics would provide a warning 
Indication, disengage the computer, or both. 

3.11.4 Additional Considerations 

It Is appropriate to note at this point, that as a result of the 
generalized nature of digital computers, such general-purpose 
equipment can fall In a general manner (failure manifestation can 
range from wholesale and obvious to subtle, unpredictable, and 
Insidious). Soft faults are a classic example of such general 
unpredictable operation. Transparent recovery Is an approach to 
handling soft faults that Is general In nature. As such, It Is 
consistent with the nature of digital processor based equipment 
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3.11.4 Additional Considerations (Continued) 

and will be effective for such general purpose programmable 
machines. In addition, transparent recovery has received strong 
endorsement by key technology specialists within the FAA. Generic 
faults Is another example of a fault category that Is general In 
nature. N-verslon hardware and software (dissimilar redundancy) 

Is a general approach for handling generic faults. To eliminate 
the threat of destroying or permanently scrambling program 
Instructions stored within digital avionic equipment memories, 
software resides In Read-Only Memory (ROM) so that even If the 
logic states of ROM elements are momentarily changed by 
transients, they will return to normal state after the transients 
die out. The use of ROM Is yet one more example of the 
application of a general approach to effectively manage digital 
processor operation. The point being made here Is that general 
purpose machines require approaches that are general and broad 
enough In scope to provide the coverage needed to eliminate or 
minimize (to an acceptable level of confidence) undesirable and 
unpredictable operation. 

When such general approaches are Implemented, the resulting 
general purpose machine will require correspondingly general 
purpose methodologies and associated capabilities to 
verlfy/val Idate Its proper operation. Such capability would need 
to be broad In scope and based upon an Integrated top down 
approach. 

3.12 Backup System 

3.12.1 Mechanical Backup 

A mechanic backup provides the greatest degrees of dissimilarity 
and physical Isolation with regards to a microprocessor based 
software Implemented FBW primary flight control system. The 
Airbus A320 has Incorporated a "minimal flight control" mechanical 
backup. While a mechanical backup Is relatively easy to verify 
with conventional FMEAs , It cannot be Incorporated In the FCCs, 
requires special Interfaces, and defeats some of the weight 
savings achieved by a FBW system. Essentially a mechanical backup 
Is a step backward for a FBW flight control system. 

3.12.2 Electronic Backup 

Electronic backups can either be packaged In separate LRUs or 
Incorporated In the FCCs. Electronic backup flight controls 
packaged In separate LRUs provide a higher degree of physical 
Isolation, but also requires that the new electronics box(es) be 
validated, shielded, and Interfaced separately. Thus electronic 
backups packaged In separate LRUs tend to Increase system 
complexity In terms of Installation and maintenance. Since 
sufficient physical Isolation can be achieved for an electronic 
backup Incorporated In the FCCs this method Is more attractive and 
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3.12.2 Electronic Backup (Continued) 

cost effective than separately packaged LRUs. Furthermore, If the 
electronic backup Is Incorporated In each FCC we would have 
redundant backups whereas If a separate backup LRU Is used there 
would probably be only a single backup LRU. 

The particular type of electronic backup flight control system 
chosen (e.g. analog vs digital) and whether a dedlcted backup 
channel Is needed or desirable will depend somewhat on the overall 
FBW configuration. 

3.12.2.1 Analog Backup 

Analog backups have the benefit of being extremely dissimilar with 
respect to microprocessor based software Implemented FBW flight 
control systems. They are also relatively easy to verify using 
standard FMEAs . It Is presumed a separate analog backup channel 
would be used. 

3.12.2.2 Digital Backup Using Discrete Hardware 

This type of backup Is very dissimilar with respect to 
microprocessor based software Implemented FBW flight control 
systems. These systems can be verified using standard FMEAs but 
analyses are more difficult than In the analog case. 

3.12.2.3 Digital Back Using Microprocessor Based Software Implementations 

This technique could use a "minimal complexity" unique software or 
a "recovery block" technique which reverts to a simplified primary 
software. The unique method provides greater backup software 
dissimilarity, but would cost more to develop. Both unique backup 
software and simplified primary software would require extensive 
Level 1 software verification If Included as a production system. 
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TABLE 4.0-1 

FLY-BY-LIGHT Subsystems and Associated Optical Hardware 


8UB8YSTEM 

Avionics Data Bus 

Fly-By-Light Data Bus 
Sidcstick Cowaond Optical Sensing 

Rudder Command Optical Sensing 
Spcedbroke Lever Conwnand Optical Sensing 
Optically Powered Flop and Slot Position Indicating 

Auto-Throttle Input Optical Sensing 
Throttle Lever Conrond Optical Sensing 
Auto- Throttle Optical Switch Sensing 


OPTICAL HARDWARE 

Linear and/or Star Data Bus with ARINC 629 or MIL- 

STO-15538 Protocol 

IRS Optical Rate Gyro 

Optical Taps 

Bidirectional Couplers 

Electro-Optic Converters 

Tree Data Bus with ARIMC 629 or 
Hll-STD- 1553B Protocol 
1x2 Bidirectional Couplers 
1x3 Bidirectional Couplers 
Electro-Optic Converters 

Position Sensors 
Pressure Sensors 
Optical Taps 

1x2 Bidirectional Couplers 
Multiplexers 

Electro-Optic Converters 

Posi t ion Sensors 
Pressure Sensors 
1x2 Bidirectional Couplers 
Hul t iplexers 

Electro-Optic Converters 

Position Sensors 
Rotary Swi tch 

1x2 Bidirectional Couplers 
Mul tipi oxers 

Electro-Optic Converters 

Optically Powered Modules 
Position Sensors 
Star Couplers 

1x2 Bidirectional Couplers 
Mul tipi exers 

Electro-Optic Converters 

Acceleration Sensor 
Posi t ion Sensors 
Data Links 

Electro-Optic Converters 

Posi t ion Sensors 

1x2 Bidirectional Couplers 

Mul t iplexers 

Electro-Optic Converters 

Lover-Actuated Switches 
Pushbutton Switches 
1x2, 1x3, 1x4 Bidirectional Couplers 
Mul t iplexers 

Electro-Optic Converters 


F 1 y-By-LI ght Subsystems and Associated Optical Hardware 
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4.0 FLY-BY-LIGHT ARCHITECTURES AND TECHNOLOGY SUITES 

A. In this section some possible architectures for near term, 
medium term, and long term fly-by-wire (FBW) are described. 
Probable technology suites and some general subsystem designs 
and approaches will also be provided and discussed. 

Table 4.0-1 Is a summary of the fly-by-llght subsystems and 
Associated Optical Hardware. 

4.1 Flight Control Review 

4.1.1 Fly-By-WIre/Fly-By-Llght Flight Control Computer Internal 

Architecture 

A. The safety requirements associated with the Introduction of 
FBW/FBL systems for commercial transport aircraft 

(l.e., 10-9 per hour and more) result In the Incorporation of 
a high degree of redundancy and redundancy management. The 
flight control computer system which Douglas Aircraft 
Company/Honeywell, Inc. (DAC/HI) has developed Includes 
sixteen (16) digital processors. This level of redundancy Is 
without consideration of secondary redundancy. 

B. It Is anticipated that any near term supplier of FBL/FBW 
systems will Incorporate N-verslon techniques to yield a level 
of protection from certain types of generic faults. 

Honeywell, Inc. (HI) was the first organization to use 
3-verslon techniques In a production aircraft (l.e., HD-11, 
3-verslon Hardware/Software (HDW/SW) In the flight control 
computer/LSAS) . The DAC/HI developed FBW/FBL flight control 
computers use 3-verslon techniques. 

C. Another technical advancement developed for the DAC/HI flight 
control computers Is transparent recovery, to provide enhanced 
protection from the electromagnetic environment (EME) while 
providing a means to, In effect, bypass "soft faults". 

D. Various architectures, gathered from literature searches, 
would be analyzed to ascertain the relative merits with regard 
to complexity, reliability, maintainability, cost, etc. This 
task should be completed assuming Fiber Optic 
Architecture (F0A) technology. 

E. All fiber optic architecture will require Input and 
output (1/0) Interface electronics since the current 
electronic systems are unlikely to be overtaken by a new 
technology In the near future. Standard Interface components 
(fibers, sizes, sensors) are crucial to the success of an 
optical architecture. Standard Interfaces will reduce 
maintainability and Installation costs and complexity. 
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4.1.1 Fly-By-Wire/Fly-By-Light Flight Control Computer Internal 

Architecture (Continued) 

F. The first generation FBL data bus will be a linear, 
multi-terminal (one flight control computer and 9 to 24 
actuators) network. The flight control computer will transmit 
position commands to the actuators and each actuator will 
provide the flight control computer with status and feedback 
data. An ARINC 629 protocol will be used. 

G. A second generation FBL data bus could evolve with the 
maturity of fiber optics and fault tolerant computing. All 
aircraft subsystems may communicate on a single high speed 
bus. Such a system would most likely employ active networking 
to accommodate the large number of terminals. 

4.2 Fly-By-Light Data Bus 

A. Fiber optic flight control systems need to be developed to 
address such Issues as higher Immunity requirements for EME 
effects, enhanced survivability and reliability, Increased 
data transmission capacity, and reduced aircraft weight. As 
EME Immunity requirements are being raised, the Increased use 
of composite structures on aircraft Is decreasing the natural 
EM shielding heretofore provided by all metal aircraft skins. 
This situation creates some very real problems, especially for 
FBW aircraft. While It Is feasible to shield the line 
replaceable units (LRUs), shielding all the data busses and 
sensor systems In remote areas of the aircraft would be costly 
and add excessive weight. Because of their Inherent EME 
effects Immunity, fiber optic systems provide a potential 
solution to this problem. Integrated fiber optic flight 
control systems use fiber optics for most data communications, 
as well as for sensor and sensing subsystems. 

B. Fiber optic data busses are the cornerstone of Integrated 
fiber optic flight control systems. Linear and/or star types 
will be used for the avionics and communications data busses, 
and tree types will be used for FBL data busses. 

C. The linear and star types will be used to Interconnect the 
major LRUs. These data busses should be capable of supporting 
32 or more bidirectional terminals. In general, star 
configurations have a better power budget than their linear 
counterparts. However, a single point failure may 
Incapacitate the entire bus. 
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4.2 Fly-By-Light Data Bus (Continued) 

D. For a linear-type data bus, asymmetric couplers and 
nonlntruslve taps are currently the most attractive techniques 
to couple the terminals to the bus fiber. There are three 
basic linear data bus configurations. The dual-fiber approach 
has the best power budget and the least-impacting single-point 
failures, but It requires twice the number of transceivers and 
terminations as the single-fiber loop configuration as well as 
a dual-fiber Installation. The single-fiber configuration has 
the worst power budget and requires twice the number of 
transceivers and terminations as the single-fiber loop 
configuration. While a single failure has potentially more 
impact on a single-fiber configuration than on a dual-fiber 
approach, It cannot bring down the entire single-fiber bus. 
Presumably a single-fiber configuration would be easier to 
Install than a dual-fiber configuration. The single-fiber 
loop configuration uses the fewest transceivers and 
terminations, has a better power budget than the single-fiber 
configuration, and would be relatively simple to Install, but 
a break at the loop would result In a failure of the entire 
bus . 

E. If the star coupler falls In any of Its configurations, then 
the entire bus falls. The transmissive star configuration has 
a better power budget than the reflective star configuration, 
but requires twice as many fibers and terminations. 

NOTE: The 1x2 couplers In the reflective star data bus would 

be Incorporated In the transceiver. 

F. The bidirectional passive tree type FBL data busses are used 
to communicate commands from the flight control computers to 
the actuators, and status and position feedback from the 
actuators to the flight control computers. In this 
configuration, the actuators do not communicate with each 
other. A failure In the coupler closest to the flight control 
computer or the Intervening Interconnection will cause the 
entl re bus to fal 1 . 

4.3 Fiber Optic Aircraft Architectures 

Table 4.3-1 summarizes the projected evolution of FBL aircraft 

architectures . 
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4.3 Fiber Optic Aircraft Architectures (Continued) 

In the near term, fiber optics will directly replace existing 
electrical data busses and links. The current architectures will 
retain the electronic feedback sensors and switches by using 
opto-electrlc converters to Interface with the fiber optic data 
links. In the long term, DAC/HI will develop fiber optic bus 
architectures with "star", "tree", and eventually "linear" 
configurations. The electrical sensors will be replaced by fiber 
optic sensors and switches which will be simple, passive devices 
that are lighter and more EMI Immune than their electrical 
counterparts. Eventually, all optical aircraft systems will be 
optically multiplexed for very high speed data busses to reduce 
the wiring required and allow more channels on the same bus. 
Ultimately, the aircraft fiber optic control system will be 
Integrated with the fiber optic filaments embedded In "smart skin 
composite structures to monitor structural health and failure. 

As Configuration 1 (Figure 4.3-1) shows, the first step to 
Implementing FBL Is to directly substitute fiber optic links Into 
current discrete LRU FBW systems. In this example, quad redundant 
flight control computers have dedicated data links to every flight 
control surface and engine. Similarly, the triple redundant 
secondary flight control computers each have a dedicated link to 
each flap, slat, and spoiler surface. This Is a typical 
FBW architecture and has many wires. By substituting fiber optics 
for wires, the aircraft architecture will show weight savings and 
Increased EMI Immunity. The displays, propulsion controls, and 
sensors will all have dedicated data links as they do now. 

Configuration 2A (Figure 4.3-2) shows the next evolution of a 
FBL aircraft. The aircraft sensors and video displays will still 
have dedicated fiber optic links but now the primary and secondary 
controls will each have their own Integrated "tree" or "star" 
fiber optic data bus. This will take advantage of the fiber optic 
medium's ability to handle higher data rates and to handle many 
channels on the same bus. Here each branch or arm of the data bus 
connects to a control surface. For the flight control computers, 
each branch connects to a rudder, elevator, or aileron surface. 

For the secondary flight control computers, each branch of the 
"star" fiber optic data bus connects to a flap, slat, or spoiler. 
This architecture reduces the amount of wiring or fiber optic 
links from the previous architecture. 

Configuration 2B (Figure 4.3-3) further simplifies the flight 
control architecture after the "linear" fiber optic data bus has 
been developed. In this configuration, all the flight control 
computers primary surface and engine controls are multiplexed onto 
a single linear data bus for each flight control computer and 
duplicated for redundancy. Similarly, each secondary flight 
control computer has a double redundant pair of linear data busses 
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FIGURE 4.3-1 

Fly-By-Light Configuration 1 
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4.3 Fiber Optic Aircraft Architectures (Continued) 

routed throughout the plane to the secondary surfaces. Although 
the displays and sensors still have dedicated data links, the 
engine Full Authority Digital Engine Control will be Integrated 
with the primary flight controls In the flight control computers 
and all the surfaces' data links will be reduced. This saves 
manufacturing time and weight. 

Standard Integrated Modular Avionics (IMA) will provide the 
technology to produce the architecture In Configuration 3 
(Figure 4.3-4). Here, all the aircraft systems are Integrated 
Into one avionics rack which contains standard processor modules 
that perform specific aircraft functions. The Line Replaceable 
Modules (LRMs) differ only In the software that has been 
downloaded to them. The IMA rack Is replicated four times for 
redundancy. Fiber optic data busses also Interconnect the racks 
and modules to allow the processors to share tasks. All the 
primary and secondary flight controls are Integrated as well as 
the sensors, displays, and radio systems. All the systems 
communicate along a single fiber optic data bus routed throughout 
the plane and duplicated for redundancy. The technology for IMA 
should eventually become standard through the ARINC 651 program or 
the USAF "Pave Pillar" program. The IMA architecture will allow 
reduced maintenance cost. Increased fault tolerance, Increased 
self healing, and reduced weight, space, and wiring. Also, by 
then, the technology for fiber optic sensors and switches will be 
developed. These will allow completely fiber optic systems to be 
EME effects Immune and will eliminate the need to route electrical 
power for sensors. 

Finally, by the 21st century, FBL should evolve to Configuration 4 
(Figure 4.3-5). Here, the fiber optic technology uses optically 
multiplexed high speed data busses and smart skins. Future 
technology will take full advantage of the high bandwidth of fiber 
optic busses to accomplish high speed optical multiplexing. This 
will greatly reduce the number of data links required and will 
save weight and space. The fiber optics embedded In the composite 
skin will aid manufacturing while the composite Is being processed 
and can sense skin temperature, pressure, strain, and failure of 
the structure skin while the plane Is In service. This can be 
Integrated with the control laws for active surface control. 
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Fly-By-Light Configuration 4 


4783S 


4-12 


Fly-By-Light 

Technology Development Plan 


4.4 Fiber Optics Subsystem Design 

4.4.1 Avionics Data Bus Subsystem 

The avionics data bus subsystem entails the development and 
validation of a multi-terminal (32 to 50) bidirectional optical 
data bus. Both linear and star configurations need to be 
developed for this application. ARINC 629 would be used for the 
bus protocol In this subsystem, which Is designed to Interconnect 
the main aircraft avlonlcs/f 1 Ight control boxes. 

A diagram of a typical Avionics Bus subsystem Is shown In 
Figure 4.4-1 . 

The optical technology areas required for the development of this 
subsystem are: 

Linear Data Bus - low loss taps, low loss couplers, transceivers. 

Star Data Bus - Transmissive or reflective stars, low loss 
couplers, transceivers. 

4.4.2 Fly-By-Light Actuator Data Bus Subsystem 

The fly- by- light actuator data bus subsystem entails the 
development and validation of a multi-terminal (one flight control 
computer and nine Actuators) bidirectional optical tree data bus. 
This subsystem Is designed such that the flight control computer 
transmits position commands to the actuators and each actuator 
provides the flight control computer with status and feedback 
data. Communication among actuators Is neither desired nor 
permitted In this configuration. ARINC 629 would be used for the 
bus protocol In this subsystem. A possible configuration for this 
subsystem Is shown In Figure 4.4-2. Also a more detailed diagram 
Is shown In Figure 4.4-3. 

4.4.3 Sldestlck Command Optical Sensing Subsystem 

The sldestlck command optical sensing subsystem entails the 
development and validation of optical position or pressure/force 
sensors In a conventional sldestlck controller. An example of a 
possible sldestlck Is shown In Figure 4.5-4. This sldestlck would 
require two optical sensors, one each In pitch and roll. The two 
optical sensors are multiplexed on a single trunk fiber with the 
command position data being decoded at a remote electronics unit. 
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Fiy_By-L1ght Actuator Data Bus Subsystem 
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Fly-By-Light Actuator Data Bus Subsystem Detailed Diagram 
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FIGURE 4.4-4 

Sldestlck Command Optical Sensing Subsystem 
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4.4.4 Rudder Command Optical Sensing Subsystem 

The rudder command optical sensing subsystem entails the 
development and validation of optical position or pressure sensors 
to Interface with conventional rudder pedals. The subsystem will 
require one optical sensor for each rudder pedal. If both rudder 
pedals are optically Interfaced, optical multiplexing can be 
Incorporated Into the subsystem design. In Figure 4.5-5 Is a 
rudder command optical sensing subsystem that DAC Is developing 
for an IRAD project. 

445 Optically Powered Flap and Slat Position Indication Subsystem 

The optically powered flap and slat position Indication subsystem 
entails the development and validation of ultra-low power 
optically powered sensors and a multiplexing scheme. This 
subsystem optically powers seven sensors via a single trunk fiber 
and returns position and status data to the microprocessor unit 
over the same fiber. The position data from the sensors Is 
Interpreted by a microprocessor unit which In turn drives the 
appropriate displays. This subsystem Is shown In Figure 4.4-6; 
also a more detailed diagram Is shown In Figure 4.4-7. 

4.4.6 Autothrottle Optical Sensor Subsystem 

The autothrottle optical sensor system entails the development and 
validation of optical accelerometers, position sensors, and data 
links. This subsystem Is designed to permit different portions to 
be Implemented Incrementally. A diagram of an autothrottle 
optical sensor subsystem that DAC Is developing for an IRAD Is 
shown In Figure 4.4-8. 

4.4.7 Throttle Lever Command Optical Sensing Subsystem 

The throttle lever command optical sensing subsystem entails the 
development and validation of an optical position sensor that Is 
Interfaced with a conventional throttle quadrant. The subsystem 
will require one optical sensor for each throttle lever. Optical 
multiplexing can be Incorporated Into the subsystem design. A 
typical throttle subsystem Is shown In Figure 4.4-9. 

4.4.8 Autothrottle Optical Switch Sensing Subsystem 

The autothrottle optical switch sensing subsystem entails the 
development and validation of optical limit switches to be 
Installed on the throttle quadrant to provide autothrottle 
disconnect, TO/GA, low limit, and reverse thrust Inputs to the 
flight control computers. An autothrottle switch subsystem Is 
shown In Figure 4.4-10. 
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Rudder Command Optical Sensing Subsystem Diagram 
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FIGURE 4.4-6 

Optically Powered Flap and Slat Position Indication Subsystem 
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SERIAL 
TEST PORT 



FIGURE 4.4-7 

Optically Powered Flap and Slat Position 
Indication Subsystem Detailed Diagram 
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FIGURE 4.4-8 

Autothrottle Optical Sensor Subsystem Design 
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Throttle Lever Optical Command Position Sensing Subsystem 


4783S 


4-23 












ELECTRONICS COMPARTMENT 


Fly-By-L1ght 

Technology Development Plan 


FINAL REPORT 
30 August 1990 



^ § = §l FIGURE 4.4-10 
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Autothrottle Optical Switch Sensing Subsystem Diagram 
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5.0 


5.1 


5.1 .1 


5.1 .2 


IMPACT OF FLY-BY-LIGHT (BENEFIT ANALYSIS) 


Background 

In this section, the weight and cost benefits of 

fly_ by— 1 Ight ( FBL) will be discussed for two classes of commercial 

transport aircraft, a narrowbody and a wldebody. 


EME Immunity 


Immunity to the effects of the EME, weight savings, and high 
bandwidth currently drive the development and Implementation ot 
fiber optics on aircraft. 


Both military and commercial aircraft users have experienced "soft 
faults" or erroneous system failure messages resulting from 
Interference by the EME of their avionic systems. The long runs 
of electrical signal wire and data busses act like an antenna 
running the length of the plane. These pick up electrlca noise 
from the environment and from each other. The airlines blame sof 
faults for 40% of their aircraft downtime and claim that 60% ot 
the avionics LRUs removed come back with "no fault found" messages 
attached and the military suspects such Interference causes 
certain unexplained accidents. Since fiber optics are Inherently 
Immune to EM fields, they will reduce or eliminate Interference 
caused by electromagnetic noise. The military customers need the 
fiber optic components performance benefits. Specifically, tne 
military requires the high data transmission rate provided by 
fiber optics, the weights savings they provide, and their Immunity 
to the EME for electronic warfare protection. 


In addition, the commercial customer will benefit from fiber 
optics through reduced manufacturing costs and a greater return on 
their Investment from the aircraft. Many manufacturing steps are 
simplified with fiber optics. Also, aircraft fiber optic data 
lines exhibit the performance advantages over their electrical 
counterparts. Note that additional safety benefits result from 
the optical fiber's Inherent Immunity to short circuits and sparks. 


Weight Savings 

Directly substituting fiber optic data links for wire signal paths 
would significantly reduce weight on aircraft. Furthermore, since 
fiber optics have a higher bandwidth than wire, fiber optic data 
busses have much higher data transmission rates than electrical 
data busses. Video display drivers, backplane data busses, and 
other high speed applications require these high transmission 
rates. Also, the higher bandwidth allows equivalent electrical 
data bus runs to be replaced with one tenth the amount of fiber 
optic wire runs to greatly reduce aircraft weight and production 

cost. 
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5.2 Narrowbody Aircraft 

For the narrowbody, the MD-88 will be used as the baseline and a 
series of evolutionary changes will be compared Involving the 
flight control and engine control systems. This will encompass 
mechanical, fly-by-wire (FBW) , and near and medium term FBL. Both 
sensor and data distributions are Incorporated In this analysis. 

5.2.1 Narrow Body Comparison 

To estimate the weight savings expected for a narrowbody aircraft, 
we calculated the wire weights for an MD-88 aircraft and scaled 
these as appropriate to equivalent fiber optic weights. 

Figure 5.2-1 shows the dimensions and general features of an MD-8U 
derivative aircraft and all the primary and secondary flight 
control surfaces which would have fiber optic lines routed to them 
In a FBL configuration. Table 5.2-1 summarizes the Immediate 
weight savings realized by direct substitution of fiber optics for 
wire on the aircraft In the current configuration. This shows a 
352 lbs weight savings In flight controls and 804 lbs for the 
aircraft. Table 5.2-2 shows a long-term FBW configuration giving 
a 750 lb weight savings over the current mechanical system. The 
advanced FBL configuration would save 1200 lbs. The long-term 
configuration would be designed to take full advantage of the 
FBW technology. 

Table 5.2-3 compares the three configurations In terms of 
engineering, development and recurring cost and compares the three 
maintenance life cycle costs. Notice that conventional electrical 
cable requires maintenance for Its shielding. Fiber optics do not 
require this shielding and can save the cost of Its maintenance. 
Table 5.2-3 then totals the Direct Operating Cost and Return on 
Investment for the three configurations. It shows a 7.5% 
reduction In direct operating costs for FBW and a 10% reduction 
for FBL. There Is a 9.6% Improvement In return on Investment for 
FBW and a 20% Improvement for FBL. Therefore, Implementing fiber 
optics on aircraft would greatly reduce the cost of ownership of 
aircraft and Increase the profit of operating them. 

5.3 Wldebody Aircraft 

For the wldebody, a concept aircraft similar to the M0-11 
(mechanical control with full time stability augmentation) will be 
used as the baseline. For this study, to exemplify the benefits 
achieved by converting long wire runs In data distribution systems 
to fiber optics, only the flight control computers to actuation 
system are converted to fiber optics. 
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Direct (signal to signal) Conversion of night Control 
8ignal Vires to Fiber Optics for a HD - 80 Type Aircraft 


Total Signal Path Length 
Signal Wire Weight 
Signal Fiber Optic Weight 

Approx. Weight Savings 


Flight Control 
41,040 ft 
418 lbs 
66 lbs 
352 lbs 


Aircraft 
93,540 ft 
954 lbs 
150 lbs 

804 lbs 


* wire 20 twtt shi laded/ jacketed 

* fiber 100/H0 Micron jacketed 

* wire grand return loope eliminated for fiber optics 

* new electro-optics (Tx « *x) added 


TABLE 5.2-1 

Narrowbody Height Comparison 



Mechanics! 
»— «»<ne 

fly-iv-Wire 

Her Tens Lang Ters 

flrtrtfWit 
gser Isa lw Term 

Cockpit Co— nds 
(MANUAL CONTROLS) 

105 

94 

94 

90 

85 

Flight and Propulsion 
Control Avionics 

270 

380 

200 

380 

200 

Avionics 

1223 

823 

790 

823 

790 

Electrical Power 


100 

150 

100 

150 

Flight end Propulsion 
end Display Control 

55 a 

310 

85 

70 

18 

Aircraft Sensors 

380 

426 

426 

140 

105 

TOTAL 

2,536 

2,133 

1.745 

1,603 

1,348 


•ell Heights in pounds 

• fUtft and propulsion control avionics include primary a* secondary 
flight control as wall as engine and actuator control electronics 

• Mechanical or other bmckv? systans not Iwtudsd 

• Mechanical baseline includes dual SOU 


TABLE 5.2-2 

Narrowbody Height Comparison 


ORIGINAL PAGE IS 

OF POOR QUALITY 
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Rarrmtady Controls Bevel opee n t and Production Coot codwlwa 



Mechanical Baseline 

Flv-Bv-IHre 

Projected 
Fly-Bv- uowr (Ron 

ItoY-Recurrina 

Eng! nearing and 
Davalopaant 

36,400,000 

*34,420,000 

$49,570,000 

mulct ta r Alrereft 

Material Coat 

$53,000 

$30,000 

$32,000 

Avionics Asaeabiy Co 

$42,000 

$21,000 

$17,000 

Equipment Coat 

$631,000 

$646,000 

$670,000 

Handl i ng/ 1 na ta ll a t i on 

$194,000 

$156,000 

$160,000 

TOTAL 

$1,120,000 

$1,055,000 

$1,099,000 


larradMdir Reintmnca lift Cyclt Coot Co^wlson 



%/m 

IZklia 


- 

%/m 

Vllfe 

Autoflight 

3*3 

$200,000 

2.6 

$166,000 

2.2 

$132,000 

Coaawi cations 

1.3 

$ 78,000 

1.0 

$ 60,000 

0.8 

$ 46,000 

flight Controls 

1.2 

$ 72,000 

0.8 

$ 46,000 

0.5 

$ 30,000 

Inst assentation 

1.1 

$ 66,000 

0.9 

$ 54,000 

0.7 

$ 42,000 

Navigation 

9.8 

$566,000 

7.9 

$474,000 

6.3 

$378,000 

TOTAL 

16.7 

$1,004,000 

13.4 

$804,000 

10.5 

$630,000 


RarrctRwdy Fli0it Controls Life Cycle Coot Co^arfson per Aircraft 


Non-Recurring 

Recurring 

Nalntanence (Labor 
Equivalent Revenue 
(relative to baseline) 


*32,000 
(*65,000) 
(* 200 , 000 ) 
(*2,642,000) nt 


*51,000 
(* 21 , 000 ) 
(*374,000) 
(*6,117.000) nt 


TOTAL 


(*2,875,000) (*6.461,000) 


DIRECT OPERATING C08T 
RETURN ON INVESTMENT 


7 . 5% reduction 
9.6% improvement 


10.0% reduction 
20.0% improvement 


utilization 6 hrs/day * 
600 aircraft production run * 
ava lift ■ 20 yra • 
60,000 flight hrs * 
"O* additional profits above * 
tha Mechanical basal! na aircraft * 


all typs fncluda flight guidance tystaa • 


ava spaad * 320 a! /hr 

ava yiald « tO.IO/paaa an ger ai. 

load factor « 0./ 

■nt* near tara weight savir^s 
costs astiaatad In 1069 dollars 

•vtragas for f ly~by~wira and f ly-by-l ight configurations 
aaehanical basal ina includes flight ar^inaar 


TABLE 5.2-3 


Narrowbody Flight Controls Developaent. Production, 
Maintenance, and Life Cycle Cost Caparisons 
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5.3.1 Dimensions 

Figure 5.3-1 shows the dimensions for a typical DC-10 aircraft 
used to estimate the cost and weight savings for a wldebody class 
aircraft. For simplicity, no flight control computer cross 
channel conversion was considered. Tables 5.3-1 through 5-3-3 
repeat the same analysis for a DC-10 baseline wldebody aircraft. 
Here, the long-term FBW configuration saves 1290 lbs and the 
FBL configuration saves 1760 lbs for near term direct substitution 
of fiber for wire, for a direct signal wire to fiber conversion we 
save 1120 lbs for flight controls and 2615 lbs for aircraft. The 
life cycle analysis shows a 4.5% DOC reduction for FBW and 7.4% 
for FBL. The analysis estimates a 5.1% Increase In return on 
Investment for FBW and a 10.2% Improvement In direct operating 
cost for FBL. Hence, Implementing fiber optics on a wldebody 
aircraft results In even greater cost savings and profit Increases 
than on narrowbody aircraft. 
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TABLE 5.3-1 

Widebody Weight Comparison 


Direct (signal to signal) Conversion of Flight Control 
Signal Wires to Fiber Optics for a MD-11 Type Aircraft 


Total Signal Path Length 
Signal Wire Weight 
Signal Fiber Optic Weight 


Flight Control 
130,500 ft 
1,330 lbs 
210 lbs 


Aircraft 
303,200 ft 
3,100 lbs 
485 lbs 


Approx. Weight Savings 


1,120 lbs 


2,615 lbs 


* wire 20 gauge shielded/ jacketed 

* fiber 100/140 micron jacketed 

* wire ground return loops eliminated for fiber optics 

* new electro-optics (Tx & Rx) added 


TABLE 5.3-2 



Widebody 

Weight 

Comparison 



Mechanical 
Basel ine 

Fly- By-Wire 

Near Term Long Term 

Fly-Bv-Light 
Near Term Long Te 

Cockpit Commands 
(MANUAL CONTROLS) 

180 

110 

110 

110 

100 

Flight and Propulsion 
Control Avionics 

300 

420 

200 

420 

200 

Avionics 

1800 

1350 

1000 

1350 

1000 

Electrical Power 


300 

400 

300 

400 

Flight and Propulsion 
and Display Control 

950 

450 

150 

180 

40 

Aircraft Sensors 

420 

500 

500 

200 

150 

TOTAL 

3,650 

3,130 

2,360 

2,560 

1,890 


* all weights in pounds 

* flight and propulsion control avionics include priinary and secondary 
flight control as well as engine and actuator control electronics 

* mechanical or other backup systems not included 

* mechanical baseline includes dual SCAS 


poor 
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Uldebody Flitfit Controls Devel 


and Production Cost 



Mechanical Easel ine 

Flv- tv-Wire 

Fly-Ov uoht (Mja) 

■on-gecurrina 
Engineering and 
Oevelopaant 

*14,000,000 

$36,000,000 

*60,000,000 

jgarrina Per Aircraft 
Material Cost 
Avionics Ataasbly Co 
Equipment Cost 
Hsndlfno/InstsUstion 

S90.000 
*70,000 
• *950,000 

*250,000 

$55,000 

$43,000 

$1,000,000 

$210,000 

*63,000 

*35,000 

*1,030,000 

*220,000 

TOTAL 

$1,370,000 

*1.308,000 

*1,348,000 


Vi debody Naintarm 

ds Life Cycle Cost 1 

Coqpsrison 


tjm S/Ufe 

tm t/Llfa 

S/iff S/Lfft 

Autof light 
C ossein icat ions 
Flight Controls 
Instrumentation 
Navi got ion 

3.7 *222,000 

1.8 *108,000 

1.7 *102,000 

1.6 t 96,000 

10.4 *624,000 

3.2 *192,000 

1.5 * 90,000 

1.0 * 60,000 

1.2 * 72,000 

8.3 *490,000 

2.6 (156,000 
1.1 S 66,000 
0.7 * 42,000 
0.8 t 48,000 
6.9 *414,000 

TOTAL 

19.2 *1,152,000 

15.2 *912,000 

12.1 *726,000 

Vi debody Flight Controls Lifo Cyclo Cost Co^isrison per Aircraft 

Son- Recurring 
Recurring 
Maintenance (Labor 
Equivalent Revenue 
(relative to baseline) 


*30,000 
(*62,000) 
(*240.000) 
(*3,409,000) nt 

*57,500 
(*22,000) 
(*426,000) 
(*7,146,000) nt 

TOTAL 


(*3,681.000) 

(*7.536,500) 

DIRECT OPERATING 

COST 4 . 5% 

reduction 

7.4% reduction 


RETURN ON INVESTMENT 


5.1% improvement 10.2% improvement 


• utilization fl hrs/dey 

• 800 aircraft production rui 

• av# lifo ■ 20 yrs 

• 60,000 flight hrs 

• •()■ additional profits above 
tho wchanical basal ins aircraft 


* ova spaad ■ 320 el /hr 

* ave yield • SO. 10/ passenger ai. 

* load factor « 0.7 

* -nt* near tern weight savings 

* coats eatiaotad in 1009 dollars 

* averages for fly-by-wire end fly-by- light configurate 


— w — -or — r nf-vf'iipu m 

all type include flight guidance syatea • aachanical baa a line includes flight «einaar 

TABLE 5.3-3 

HI debody Flight Controls Development. Production, 
Maintenance, and Life Cycle Cost Comparisons 


OR/GWal pa or n> 
0F «*>« 
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6.0 VERIFICATION, VALIDATION, AND CERTIFICATION 

6.1 Introduction 

It could be argued that designing and building a 
fly-by-wire (FBW)/ fly-by-llght ( FBL) system Is easy compared to 
the associated validation, verification, and Federal Aviation 
Administration ( FAA) certification problems. The selected VVC 
approach must address the following major areas: 

A. Electromagnetic Effects Protection 

B. System Integrity 

C. Software 

D. Flight Test 

E. Direct FAA FBL Program Participation 

Proving that a FBW/FBL commercial aircraft Is fully protected 
against hazardous effects associated with EME requires the ability 
to fully test the aircraft while It Is exposed to the threat. The 
state-of-the-art technology In this area Is generally regarded as 
Inadequate. In addition, analysis which can accurately predict 
the effects of the EME propagation Inside a complex airframe 
structure Is far from mature and yet Is deemed essential to 
FBW/FBL technology by most experts. SAE Committee AE4R Is 
struggling with these problems now. 

System design Integrity has. In the past, been demonstrated using 
bench testing, fault Insertion, and analysis. Many organizations 
tasked with development of FBW/FBL systems. Including Douglas 
Aircraft Company and Honeywell Inc., believe the complexity and 
criticality of commercial transport FBW/FBL Systems will likely 
render such methodologies Inadequate. 

A combination of Flight Test and FAA Involvement will yield an 
understanding of how to quantify technical, cost, and 
certification risks associated with U.S. built and certified 
tranport aircraft. 

Direct FAA Involvement In this program Is essential to maximizing 
the benefits to U.S. Industry. 
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6.1 


6.2 


Introduction (Continued) 

Within the context of the discussion In this section, validation, 
verification, and certification are defined as follows: 


Verification: Establishing the truth of correspondence 

between a product and Its specification; 1* e *» 
building the product right?" (Boehm, 1981). /[j® 

context of the system life cycle, this means establishing that 
the evolving system satisfies all of Its requirements. 
Verification should be performed In stages during full scale 
development of the system. 


B Validation: Establishing the fitness or worth of a 

for Its operational mission; l.e., "Are we building the right 
product?" (Boehm, 1981). Within the context of the system 
life cycle, this means establishing that the system 
requirements are correct and complete. Validation should be 
performed prior to full scale development of the system. 

C Certification: Obtaining regulatory agency approval for a 

product by establishing that It complies with all applicable 
government regulations. 


Electromagnetic Effects Protection 


6 . 2.1 


Introductl on 


The modern trend to develop aircraft with nonmetalllc composite 
materials and FBL digital flight control systems (FCS) requires a 
basic and fundamental understanding of the EME on such systems. 
These flight-critical control systems must have failure rates 
which are the same as other flight critical systems, on the order 
of one failure In 10 9 flight hours. Although FBL systems have 
eliminated EM coupling effects on signal lines, what remains are 
the problems associated with coupling to power cables and through 
the box enclosures. The challenge that the aerospace community 
now faces Is how to evaluate and mitigate EME effects and achieve 
these high reliabilities. Meeting this challenge Is a significant 
task, because of the scope and complexity of the Issues Involved. 
For example: 


A The frequency range of Interest Is from DC to 40 GHz. This 
requires a wide variety of analysis, hardening, and test 
techniques . 

B. Aircraft are mechanically (and therefore electromagnetlcal ly) 
complex In shape, materials, and construction techniques. 

C. Digital systems are also complex, having many millions of 
logic states, some of which are known and some of which are 

unknown. 
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6 . 2.1 


6 . 2.2 


Introduction (Continued) 


D. There are significant problems associated with verifying these 
high reliability rates. 

The overall objective In the EME area Is to develop a national 
resource of applicable EME assessment technology. The overall 
scope Is to develop aircraft EME models and methods that are 
experimentally validated. 


As an Integral step In an aircraft assessment using such a 
national resource, EME threat levels Inside the commercial 
aircraft would also be defined. In addition, methods and 
approaches for verification and validation of system Immunity, 
for certification of the aircraft will be developed. 


and 


The flow chart shown In Figure 6.2-1 Illustrates the complementary 
and Iterative nature of an analysis and test cycle appropriate for 
aircraft designs Involving significant departures from traditional 
practices (e.g., materials, geometries, flight critical electronic 
control systems). The processes shown In Figure 6.2-1 provide the 
characterization of the various aircraft EM responses to an 
aircraft EME Interaction. Such responses are needed for 
electrical/electronic system designs that must deal with 
protection against the effects of the EME threat. 

The Interplay between analysis and test will be present throughout 
the design, verification, validation, and certification cycle. 
Estimates of the aircraft EM responses, based upon predictions 
derived from analytic models, could be used to help formulate the 
test philosophy (e.g., flxturlzatlon, measurement points, 
measurement levels). Test measurement data will be used to refine 
analytic models. 


Technical Approach 


Consistent with the top level system position that the EME threat 
Issue occupies for flight critical electrical/electronics systems, 
the EME assessment process would Involve a comprehensive system 
(top down) approach as depicted In Figure 6.2-1. 

The design process Is the primary means that ensures that an 
aircraft system will be Immune to the EME threat. The design 
analysis data Identifies the measures Implemented and the 
corresponding worst case assessments that establish the degree of 
Immunity expected. 


Ideally, the design process would apply the capabilities made 
available by the national resource assessment technology In a top 
down approach that Is In harmony with the system topology 
perspective. 
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FROM CW TESTS 


FIGURE 6.2-1 

EME Analysis/Test Process 
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6.2.2 Technical Approach (Continued) 

The design process produces the data that provides the ana lyt1c 
and empiric assessment foundation for the verification, validation 
and certification basis and that enables the bottom up empirical 
(spot testing) checking to be effective and meaningful. The 
empirical measurements associated with the verification, 
validation and certification process complement the data from the 
design process and completes the data package needed for 
verification, validation and certification. The empirical 
activities Identified for this program Include equipment testing, 
In-sltu cable current Injections, aircraft simulated lightning 
current Injection and aircraft HIRF Illumination. 

6. 2. 2.1 Equipment Testing 

Previous activities (analyses, measurements) have determined both 
aircraft Interior EM fields levels and bulk cable current response 
levels for the various transient and CW environments. These 
Internal environments can then be translated Into equipment 
testing procedures which will Involve simultaneous bulk cable 
current Injection techniques and field Illumination. These 
procedures will be applied to aircraft systems equipment on the 
bench. The performance of these systems will be monitored and 
verified during this exposure. 

6. 2. 2. 2 In-SItu Cable Current Injection 

This activity Involves the EM stimulus of aircraft systems as 
Installed In the aircraft. The objective here Is to validate that 
the bench test results are applicable to as-installed equipment. 
Cable current Injection and local Illumination will be done on 
critical systems as Installed on the aircraft to verify that 
In-sltu performance Is the same as that of the bench test. The 
systems will be cycled through all pertinent operational modes for 

verification. 

6. 2. 2. 3 Aircraft Simulated Lightning Current Injection 

The objective here Is to validate the lightning coupling results 
from scale model data. Low level simulated lightning currents 
will be Injected Into the vehicle and cable responses will be 
monitored and compared to previous data. These Injected currents 
may be either transient or swept CW. High level currents will 
then be Injected Into the aircraft with all systems operating to 
verify scaling and system performance. It ^anticipated that the 
airplane level lightning simulation testing Identified for this 
program will verify the effectiveness of design analysis and 
subsystem/equipment testing, thus negating the need for ^plane 
level testing, for the verifications validation and certification 

process . 
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6. 2. 2.4 Aircraft HIRF Illumination 

The objective Is to validate performance In the 
HIRF environments. The aircraft will be subject to threat level 
environments. Measurements of internal fields and cable currents 
will be done to validate the scale model efforts and the bench 
testing environments. System performance In this environment will 
also be validated. It Is anticipated that the airplane level 
HIRF Illumination testing Identified with this program will verify 
the effectiveness of design analysis and subsystem/equipment 
testing, thus negating the need for airplane level testing, for 
the verifications validation and certification process. 

6.2.3 Certification Procedures 

The design and verlf Icatlon/valldatlon activities will provide the 
experience and large data base which can be used to develop the 
certification basis and associated procedures. The objective here 
Is to develop Inexpensive requirements such as analysis and bench 
testing procedures so that certification can be done without 
having to fully Illuminate or stimulate an entire aircraft. These 
procedures will be well defined, documented and justified. 
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6.3 

6.3.1 


6.3.2 


System Integrity (System Modeling) 

Introduction 

Extensive system fault effects modeling has, In general, not been 
viewed as essential to proper development of previous generation 
commercial transport systems such as CAT IIIB autoland. The 
Introduction of FBW/FBL will likely require such modeling. The 
complexity of this type system makes It essential that the 
modeling work at the National Aeronautics and Space Agency (NASA), 
LaRc Alrlab Facility (e.g., SURE, CARE III, GGL °SS» HARP), be 
enhanced and expanded to accommodate the complexities of systems 
targeted for near term application to FBW/FBL. 

The limiting factor for this technology will likely be available 
computing resources. Both gate level and system level techniques 
must be further developed and expanded. Many new approaches need 
to be explored. 


Technology Issues 

The technologies with greatest Impact on fault tolerant V&V are 
broadly categorized Into six areas: 

o System and Component Level Modeling 
o Circuit Simulation Software and Hardware 
o System Reliability Software 
o Integrated Computing Environment 
o Rapid System Prototyping Environment 
o Technology Acquisition and Transfer 


6.3.3 Strategies 

The strategy will be to develop the six technologies listed above 
to a level where they are user-friendly, cost-effective, and 
comprehensive. 


6. 3. 3.1 


odellng 

he approach will define modeling methodology at the system, 
oard, and gate levels. At the system level, DAC/HI will 
apltallze on the existing modeling tools available In the 
arketplace and at NASA, and Hi's modeling experience to develop 
ystem prototype models to demonstrate new concepts for FBW/FBL 
ontrol systems verification and validation. At the board and 
ate level modeling, the strategy will be to develop or procure 
todellng 
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6. 3. 3.1 


Modeling (Continued) 


technologies compatible with simulation systems to provide the 
means to detect faults at the gate level. The results of the 
lower level simulations will be used at the system level for 
failure modes and effects analysis. 


Develop modeling techniques to be able to transition up or 
down In hierarchy: starting at one end of the spectrum 

with gate level circuit simulation, and transitioning that 
Information In a series of steps to the system level 
reliability prediction programs. Obviously, there are many 
steps In between with the reformatting of data and the 
moving of a data base from one platform to another. 


o Utilize modeling technology to accelerate the development 
of new architectures for FBW/FBL control system. With 
user-friendly CAE systems, new configurations of FBL/FBW 
can be designed and tested In a much more timely fashion 
than conventional methods. 


6. 3.3.1 .1 


System Level Modeling 


System level analysis will Incorporate data and results from lower 
level simulation and failure mode and effect analysis to determine 
the ultimate consequence of Injected faults on the 
svstem/alrcraft. The starting points for this analysis could be 
Mentor's Qulck-Slm circuit simulation. Going through the various 
steps of gate level/chip simulation, then module simulation, and 
possibly even going to system circuit simulation (assuming there 
is enough computing power available). The ultimate goal Is to 
predict reliability and failure mode effects. 


o Initial efforts will be targeted at modeling one lane of an 
eight processor flight control system for circuit 
simulation. The processor will be modeled at the 
functional bus level primarily because the gate level model 
for the processor Is not available. Semiconductor vendors 
consider this Information proprietary. The approach then 
Is the logic and all the monitoring circuitry around the 
microprocessor will be modeled such that faults can be 
Injected anywhere. To obtain realistic simulation results, 
small pieces of application software will be transformed 
Into test vectors and simulated In the circuit. 


o Input a FBW/FBL prototype model consisting of an 
8-processor system Into SURE to evaluate SURE In Its 
ability to predict the reliability or large systems using 
single-point failures. In parallel, the same model will be 
Input Into HARP and evaluated In Its ability to detect 
transient and near-coincident failures. The size of the 
model will be expanded from 8 to 16 processors, and both 
SURE and HARP will be evaluated on their suitability to 
accurately perform reliability prediction of realistic 
FBW/FBL flight control systems. 
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6. 3. 3. 1.1 System Level Modeling (Continued) 

o Advance the development of system fault Injection and 
statistical analysis techniques to characterize the fault 
recovery of fault tolerant systems. Determine arrival time 
distribution for transient and near-coincident faults. 
Reliability modeling assumes that detection times of faults 
are exponentially distributed. This assumption and current 
sampling practices have shown to Introduce significant 
variations In system reliability estimation. Joint efforts 
with NASA's AIRLAB will be pursued to determine new 
sampling techniques and statistically robust parameter 
estimation. 

6. 3. 3. 1.2 Module Card Level Modeling 

The card level modeling simulates at the component level faults 
can be Injected at the pin I/O. 

The Information will be passed to a high level (system level) 
simulation to manifest Its system consequences. 

o Develop/procure models to perform functional and fault 

simulation of module with faults Inserted at the pin level. 

o Develop the capability to generate Behavioral Language 
Models (BLM) which can aid In our simulations of complex 
microprocessor-based modules. The capability can then be 
used to Input faults at the pin I/O level for failure mode 
effects analysis and higher-level simulation. 

o Develop libraries to support functional fault simulation of 
large microprocessor-based boards. Explore the advantage 
of hardware verification models In terms of "bus cycles." 

o Evaluate the transition to VHDL (Very High Level 

Description Language) as a standard modeling methodology 
for the system and subsystem levels. 

6. 3. 3. 1.3 Gate Level Modeling 

Gate level modeling Is the functional circuit description of large 
components (LSI, VLSI, and ASIC) using small scale Integration 
type of logic devices to describe their behavior. It has been 
classlf Ically at this level that fault simulation of complex ICs 
have been accomplished. Generic NAND gates, nor gates, Inverters, 
etc., have been typically used for this type of modeling. 

o Develop/procure gate level models to make possible gate 
level fault simulation of processor cards on fault 
simulation accelerators or high-speed general-purpose 
computers . 
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6. 3. 3. 1.3 Gate Level Modeling (Continued) 

o Develop gate level models to perform fault simulation using 
GGLOSS. 

o Develop a generic gate level library to support the 
generation of other libraries for fault simulation. 

6. 3. 3. 1.4 Modeling Tools Integration 

These are software programs to aid In the generation of both gate 
level and behavior language models and the conversion of libraries 
using standard-data formats such as Electronic Design Interchange 
Format (EDIF) , Very High Level Description Language ( VHDL) , etc. 
The tools developed should Integrate the overall modeling system 
to enable the Interfacing for one level of hierarchy to the next. 

Influence the development of Integrated system, board, and gate 
level modeling tools. Pursue the development of smart 
knowledge-based models similar to Logic Automations' Behavior 
Language SMARTMODELS to facilitate the debugging of system models. 

6. 3. 3. 2 Simulation Technologies 

Simulation technologies are critical tools In assessing system 
performance and behavior. The approach uses very high-speed fault 
simulation to provide fault coverage at the pin and gate levels. 
Failure mode effect simulations give a measure of the system 
architecture's detection and tolerance of transient and 
near-coincident faults at system levels. 

o Define methods for mapping fault coverage at the gate level 
to system levels to provide an automated Interface from 
low-level fault simulation to system level models. Also, 
develop a method for communicating results of a failure 
mode fault analysis run at low-level to a higher-level 
simulation to obtain the ramifications. 

o Benchmark NASA's GGLOSS fault simulator using a 

single-processor board executing software. Since GGLOSS Is 
a gate level fault simulator, the SDP-185-based processor 
board Is a good candidate for gate level fault simulation 
since HI has the gate level model. The SDP-185 design and 
libraries will be netllsted and transferred to the GGLOSS 
system for fault simulation on a VAX computing 
environment. If satisfactory, attempts will be made at 
simulating systems with multiple microprocessors. The 
SDP-185 Is a custom Honeywell-developed 2901-based 
processor circuit. 
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6. 3. 3. 2 Simulation Technologies (Continued) 

o Investigate the capabilities of available and developing 
fault simulators and their suitability to fault tolerant 
V&V . Explore gate level hardware fault simulators versus 
software-based fault simulators on high-performance 
computers. The initial effort will be to fault simulate 
the SOP-185 board on the existing MACH-1000 simulation 
accelerator, and compare the fault coverage to the results 
from the GGLOSS fault simulation. 

o Influence simulation vendors to modify their firmware to 
handle very-high-speed failure modes to affect the 
simulations of processors running real-time software. 

o Explore the advantages of mixed-mode (both gate level and 
behavioral language models) concurrent simulation on 
hardware accelerators and high-speed workstations. This 
Innovative system uses shared computing resource where a 
hardware accelerator simulates at the gate/transistor 
levels while coupled with a general-purpose high-speed 
workstation simulating at the behavioral model level. 

o Select/procure software simulators Implemented In a 
computing environment for deployment of a full-scale 
FBW/FBL control system verification development. 

o Develop software tools to sift and auto-compare simulation 
results at gate levels to study the propagation of Inserted 
faults to the higher levels in the system. 

o Develop user-friendly simulation tools designed to Increase 
productivity of system engineers. 

o Develop software tools to expedite the conversion of 
application software Into test vectors at the lower 
levels. Test vectors have historically been a manually 
intensive effort. Tools should be developed to aid this 
effort. 


In 


6. 3. 3. 3 Reliability Prediction 

To obtain the overall system reliability (probability of 
failure/mission) and for parameter sensitivity studies, analytical 
techniques such as Markov modeling must be used. A Markov 
reliability model calculates the probability of a system being 
various states as a function of time. A state in the model 
represents the system status as a function of the failed an 
unfailed components and the system's redundancy management 
strategy Given the system architecture and reconfiguration 
rules, the system reliability can be calculated. Other Inputs 
the model will Include fault data for sequence dependent failures, 
correlated failures, near-coincident failures, the coverage of 
transient and permanent faults, and fault arrival rates. 


to 
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6. 3. 3. 3 Reliability Prediction (Continued) 

The starting point for the system reliability modeling will be the 
software tools, SURE (Semi-Markov Unreliability Range Evaluator) 
and HARP (Hybrid Automated Reliability Predictor) .which were 
developed by NASA. Initially, one-processor then four-processor, 
(one box) and then eight-processor (two boxe ;>> configurations of 
the FBW/FBL Flight Control System will be modeled for permanent 
failures In parallel with SURE and HARP. This should help In 
assessing the capabilities and limitations of SURE and HARP In 
modeling large systems. Once this Is accomplished, other types 
failures and fault handling models will be added to the models. 
Later, the model will be Increased to 16-processor (four boxes) 
and then generalized to any number. 

6. 3. 3. 4 Integrated Computing Environment 

The Integration of the various computer resources Into a common 
envl ronment for modeling and reliability Prediction Is cr lea 
for fault tolerant V&V. At the present, modelling and reliability 
predicting time, lack of adequate processor capability 
(throughput) and processor availability are the largest obstacl 
Identified. To simulate the amount of electronic circuitry In 
FBW/FBL flight control system on today's workstation networks or 
VAX cluster Is not realistically feasible. Hardware accelerators, 
or a clever division of tasks, or very efficient models will be 
needed to make real progress at system analysis. Some of the 
associated resources that will be needed Include: 

o Parallel computer architectures with high processing 

capabilities, such as large parallel processor mainframes 
or parallel super workstations. 

o Hardware simulation acceleration. 


o Concurrent processing, 
o Fault tolerant software engineering. 

o Computer-aided engineering/network support personnel, 
o Standard networks and protocols. 


6. 3. 3. 5 Rapid Prototyping Technologies 

The success of fault tolerant verification will depend on the 
close technical cooperation between developers, customers, and 
users The traditional phase-oriented approach to system design 
assumes a strictly linear ordering of development steps. This 
approach Is not only very costly but falls to Include Important 
elements of communication and feedback In the development process, 
making system evolution a lengthy process. Rapid prototyping 
technologies used within the system development context allows the 
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6. 3. 3. 5 Rapid Prototyping Technologies (Continued) 

design and building of prototypes (models) to demonstrate the 
feasibility of systems or the evaluation of alternative system 
designs using early customer or user requirements. The resulting 
process provides a means of mapping system requirements Into a 
sequence of cycles; re-design, re-implementation, and 
re-evaluation, which allows new customer requirements to be 
quickly captured, Implemented, and evaluated before the target 
system Is built. 

The most Important techniques used In rapid prototyping are: 
modular design, Interactive human Interface, and simulation. 
Emerging development tools promote the use of these techniques at 
various levels of the system design process. Our approach will 
advance the Integration of these tools with expert systems and 
data base management to provide the environment tailored for 
prototype development. 

o Introduce Computer Aided Software Engineering (CASE) tools 
as a rapid prototyping environment for fault tolerant 
software development. Integrate expert systems and data 
base management tools to the CASE system environment to 
facilitate the creation, management, and automated 
conversion of rapid prototypes Into target systems. 

o Develop a rapid prototype for a fault tolerant test-bed 
system. This prototype facility will be used to 
demonstrate feasibility of fault tolerant V&V concepts and 
techniques . 

o Develop a rapid prototype for the generation of self-test 
programs suitable for automated validation and verification 
of fault tolerant systems. 

o Introduce VHDL as the standard modeling and simulation tool 
for the design and verification of fault tolerant v7v 
systems . 

o Influence the adoption of design for testability guidelines 
as a standard design methodology to facilitate the 
generation of testable systems. 

6. 3. 3. 6 Technology Acquisition and Transfer 

This strategy emphasizes the Importance of forming effective 
relationships with a variety of government. Industry, and 
educational organizations. Development of a national resource 
capability for verification of FBW/FBL control systems technical 
expertise In various disciplines Is Imperative. This expertise 
will be acquired through teaming with Industry technology groups, 
government research centers, universities, and Industry 
organizations . 
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6. 3. 3. 6 Technology Acquisition and Transfer (Continued) 

The critical disciplines are Identified as modeling, simulation, 
and supporting technologies. 


6.4 Software 

6 . 4.1 Evaluation of RTCA/D0-178A 

DAC/HI will work with the FAA to evaluate the adequacy of 
RTCA/D0-1 78A with regard to flight crucial systems. Specifically, 
DAC/HI will attempt to show whether the Level 1 development 
approach Is sufficient to yield a system that can meet rellab y 
requirements In the 10 - ^ range. 

6.4.2 Verification and The Software Development Cycle 

DAC/HI will Identify and evaluate verification tools and methods 
that can be applied to each of the software development actlvltle 
depicted In Figure 6.4-1. Note that Figure 6.4-1 represents a 
baseline life cycle paradigm (similar to those suggested In 
D0D-STD-21 67 and RTCA/D0-1 78A. 

6. 4. 2.1 Software Requirements Verification 

DAC/HI will Identify and evaluate tools and methods that can be 
used to verify that the software requirements are an adequate 
translation of the system requirements allocated to software and 
that Implementation Is feasible. Current state-of-the-art tools 
and techniques Include: 

A. Structured analysis tools with built-in consistency checking 
(e.g., Excelerator and Teamwork). 

B. Traceability matrices. 

C. Walk-throughs and reviews. 

D. Requlrements-based testing. 

6. 4. 2. 2 Software Design Verification 

DAC/HI will Identify and evaluate tools and methods that can be 
used to verify that the software design (top level architecture 
approach and detailed design) represents a clear, consistent, and 
accurate translation of the software requirements, adequately 
addresses all Issues peculiar to real-time embedded software 
design, and that the key algorithms are performed with the 
required precision and accuracy. Current state-of-the-art tools 
and techniques Include: 
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6. 4. 2. 2 Software Design Verification (Continued) 

A. Modeling tools that support top level architecture design and 
simulate execution. 

B. Structured design tools with built-in consistency checking. 

C. Design diversity (multi version software development). 

D. Traceability matrices. 

E. Walk throughs and reviews. 

F. Structure-based testing. 

6. 4. 2. 3 Software Implementation Verification 

DAC/HI will Identify and evaluate tools and methods that can be 
used to verify that the software Implementation (code) effectively 
and efficiently represents a clear, consistent, and accurate 
translation of the software detailed design and that It adequately 
addresses all Issues peculiar to the target environment. Current 
state-of-the-art tools and techniques Include: 

A Automatic code generation tools that accept textual (POL) or 
graphic detailed design Information and produce target code. 

B. Implementation diversity (multlverslon software development). 

C. Traceability matrices. 

D. Walk-throughs and reviews. 


E. Structure-based testing. 


6. 4. 2. 4.1 Overview of Mutation Testing for System Verification Valldatl 


on 


Software testing attempts to provide a partial ans ^er to the 
following question: If a program Is correct on a finite number of 
test cases, Is It correct In general? Several techniques have 
been devised for generating test cases. Including Input space 
partitioning, symbolic testing, and functional testing. Because 
software testing Is Insufficient to guarantee program correctness, 
these techniques do not attempt to establish absolute program 
correctness but to provide the tester with some level of 
confidence In the program. 

Although each of these techniques Is effective at detecting errors 
In the program, mutation analysis goes one step further by 
supplying the tester with Information In the absence of known 
errors. This unique ability helps the tester predict the 
reliability of the program and Indicates quantitatively when the 
testing process can end. Mutation analysis has been shown 
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6. 4. 2. 4.1 Overview of Mutation Testing for System Verification Validation 
(Continued) 

analytically and experimentally to be a generalization of other 
testing methodologies. Thus, a mutation analysis tool gives a 
tester the capabilities of several other test techniques as well 
as features that are unique to mutation. The following discussion 
describes the mutation approach to software testing. 

A. Theory of Mutation Analysis 

Mutation analysis Is a powerful technique for software testing 
that assists the tester In creating test data and then 
Interacts with the tester to Improve the quality of the test 
till Mutation analysis Is based on the -competent programme 
hypothesis- - the assumption that the program to be tested has 
been written by a competent programmer. Therefore, If tne 
program Is not correct, It differs from the correct program by 
at most a few small errors. Mutation analysis a lows the 
tester to determine whether at set of test data Is adequate to 
detect these errors. The first step In mutation analysis Is 
the construction of a collection of mutants of the test 
program. Each mutant Is Identical to the original P r ° 9 ^m 
except for a single syntactic change (for example, replacing 
^operator by another or altering the value of a constant). 
Such a change Is called a mutation. Each mutant Is then 
executed, using the same set of test data each time. Many o 
the mutants will produce different output than the original 
program. The test data Is said to kill these mutants, the 
data was adequate to find the errors that these mutants 
represent. Some mutants, however, may produce the same output 
as the original program. These live mutants provide value 
Information. A mutant may remain alive for one of two reasons. 

o The test data Is Inadequate. The test data failed to 
distinguish the mutant from the original program. For 
example, the test data may not exercise the portion of 
the program that was mutated. 

o The mutant Is equivalent to the original program. The 
mutant and the original program produce the same 
output, hence no test case can distinguish between the 

two. 

Normally, only a small percentage of mutants a pe ejujvalent to 
the original program; these are usually easy to locate and 
remove from further consideration, more test cases can be 
added In an effort to kill non-equivalent mutants. The 
Aripnuacv of a test set of test cases Is measured by an 
adequacy score; a score of 100% Indicates that the test cases 
kill all non-equivalent mutants. 
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6. 4. 2. 4.1 Overview of Mutation Testing for System Verification Validation 
(Continued) 


B. Mutation Testing System 

A mutation-based testing system allows a tester to Perform 
mutation analysis on a program (or sub-program). The tester 
supplies the program to be tested and chooses the types o 
mutations to be performed. The tester also supplies one or 
more test cases. The testing system executes the original 
program and each mutant on each test case and compares the 
output produced by the two programs. If the output of the 
mutant differs from the output of the original program, the 
mutant Is marked dead. Once execution Is complete, the tester 
can examine any mutants that are still alive. The tester 
then declare a mutant to be equivalent to the original 
program, or the tester can supply additional test cases In an 
effort to kill the mutant (and possibly other live mutants as 
well). Some mutation systems are able to detect automatically 
certain kinds of equivalent mutants. 


Several mutation systems have been built over the past ten 
years. Including PIMS, EXPER and FMS.3, which supported 
mutation analysis for Fortran programs, and CMS.l, whicn 
handled COBOL. The most recent mutation-based system is 
Mothra, an Integrated software testing environment under 
development at Purdue University's Software Engineering 
Research Center. 


the 


Experience with Mothra and earlier systems has shown mutation 
analysis to be a powerful tool for program testing. 
Mutation-based testing system have a number of attractive 
features : 


o Mutation analysis Includes - as special cases - most 
other test methodologies. Statement coverage and 
branch coverage are among the methodologies that 
mutation analysis subsumes. 

o A mutation based system provides an Interactive test 
environment that allows the tester to locate and 
remove errors. 

o Mutation analysis allows a greater degree of 

automation than most other testing methodologies. 

o Mutation analysis provides Information that other test 
methodologies do not. In particular, the mutation 
score for a particular program Indicates the adequacy 
of the data used to test the program, thereby serving 
as a quantitative measure of how well the program has 
been testing. 
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6 . 4 . 2 . 4.1 


6 . 4 . 2 . 4. 2 


Overview of Mutation Testing for System Verification Validation 
(Continued) 

A potential problem of mutation based testing systems Is the 
amount of computer resources (both space and time) required 
for the testing of large programs. The number ^ 

qenerated for a program tends to grow quadratlcally with 
number of names In the program. Storing huge number; s of 
mutants can be difficult on many c°n«puter syst^s; executing 
that many mutants Is an even larger problem 
there are several ways to overcome the problem of limited 

resources: 

o Mutant sampling. Mutation systems allows the tester 
to specify random sampling of a certain percentage of 
mutants. Often, sampling even a small percentage of 
the possible mutants Is enough to reveal Inadequate 
test data. 

o Selective application of mutant operators . JJ u J- a JJ on 
systems also allow the tester to specify that only 
certain kinds of mutations are to be performed. Thus, 
the tester can select mutations that are likely to 
have a high payoff relative to the amount of time they 

require. 

o Use of high performance computers. Computationally 
Intensive tasks of mutation testing can be performed 
on high-speed computer systems such as parallel 
architectures and vector machines. 

C. Evaluation of Mutation Testing 

Mutation testing covers the class of errors known as 
blunders. Blunders are errors In which the s 0 ( twa J® 1 d "[ 
do what the programmer Intended. This contrasts with deslg 
errors In which the software does what the programmer 
Intended, but the Intended functionality Is not correct. 
Blunders Include typographical errors, the ® . ' 

the use of wrong variables, etc. This type of err0 [ 1s ®^ 1er 
to find than design errors. Most blunders are caught elt 
by compilers that translate strongly typed languages, such as 
Ada or by existing methodologies used In the development of 
highly reliable software. The much more difficult problem of 
testing for design errors still needs to be addressed. 

Overview of Architectural Design and Assessment System (ADAS) 

ADAS Is a set of computer-aided engineering tools which support a 
methodology for the architecture level design and analysis of 
software algorithms and their hardware Implementations. roug 
an Iterative design process, software and hardware designs 
analyzed and refined to approach a final design. 
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6. 4. 2. 4. 2 Overview of Architectural Design and Assessment System (ADAS) 
(Continued) 

ADAS uses directed graphics to model software and hardware 
systems. An ADAS directed graph consists of node and arcs. 

Nodes represent Individual software operations or hardware 
functional elements. Arcs represent the flow of data or control 
from one node to another. Both nodes and arcs have name and other 
attributes associated with them. The attributes provide the 
Information necessary for modeling the system under study. A 
graph can contain a cycle, which represents a flow of data that 
returns to the node that originates It. There Is nothing 
Intrinsic to the graph to Indicate whether It represents a 
software or hardware model. Some associated ADAS graph attributes 
are defined as follows: 

queue size Is the maximum number of tokens allowed on the 
arc . 

firing delay Is the length of time the node Is busy after It 
Is enabled to fire (Input, resource, and output conditions are 

all met). 

ha-module Is the hardware resource to which the node Is 
mapped. If two nodes are enabled to fire at the same time, 
and the nodes have Identical hardware resources, then their 
firing Is serialized. 

priority may be used when there Is resource contention, to 
allow deterministic sequencing of the nodes. If the default 
Is used, ADAS schedules the nodes according to an Internal 
algorithm. 

threshold defines the number of tokens which must be on a 
given arc In order for the node to fire. 

consume defines the number of tokens consumed from the arc 
when the node fires. 

produce Is the number of tokens the node produces when It Is 
done firing. 

In addition, nodes and arcs have many other attributes Including 
those which determine graph appearance, such as size, color and 
position. There are also attributes which can point to files 
which contain behavioral models or other user defined simulation 

data. 

In order for an ADAS node to fire, certain criteria must be met. 
There must be sufficient tokens on the Input arcs to satisfy the 
threshold and consume values of one or more arcs. The hardware 
resource must be available. Finally, there must be sufficient 
space on the output arcs to satisfy the produce values. 
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6. 4. 2. 4. 2 Overview of Architectural Design and Assessment System (ADAS) 
(Continued) 

When all the conditions are met for a node to fire, It 
consumes the tokens from Its Input arcs. If a behavioral model Is 
Dresent It Is executed. Then the node delays for a specified 
time equal to Its firing delay, locking out Its resource from 

other nodes. When the appropriate time has p J ssed '^ h ® ..[nut^rcs 
Is released and tokens are produced and placed on the output 


6.4.3 


than the basic ADAS model are required, 
n Ada or C may be used. These allow 
nodes, stochastic values of attributes 
name] may be used to point to a file 
the user defines. This could Include 
e.g. GaAs , SI), degree of parallelism 
of fault tolerance used, etc. The 
be designed to use this Information In 


If models more complicated 
behavioral models written 1 
complex Interaction between 
such as [/em node user file 
containing any Information 
Implementation technology ( 
available In the node, type 
behavioral model would then 
an appropriate fashion. 

ADAS tools provide detailed simulation results for the performs 
analvsls and evaluation of a design. Statistics sucn as 
utilization and latency may be collected for hardware modules and 
software nodes. Flow rates and access frequencies may be 
collected for arcs. ADAS uses both simulation-based and 
analytical techniques to calculate performance characteristics. 

a mpnu-drl ven qraphlc editor Is used to construct and modify the 
software and hardware graphs. Other tools analyze the performance 
Of the models, allocate software tasks to hardware graph 
components, and provide functional simulation capabilities. 
Attributes associated with the model components are used to check 
for design Inconsistencies. 

Software Verification Effectiveness Measurement 


6. 4. 3.1 Quantifying Software Reliability 

Software reliability Is the probability that the software will 
mppt reaulrements for a given period of time In a specinea 
environment Software reliability measurements are based on the 
freouencv with which problems (l.e., design faults, operational 

tto« unrecognized design defects are the primary 
? "ri source°for software.’unllke hardware rellabl t, where 
physical causes and wear play Important roles. Models ^e eltner 
based on the external behavior of a system or ° n J*® ! S ^ t the 
structure The models represented here are all based on the 
svstem's external behavior. The values of the parameters In the 
modeling systems must be estimated sometimes. Different Inference 
»?ocedu?e have been devised to calculate the parameters optimum 
Mine These prediction systems will not be discussed here. 
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6 . 4 . 3.1 


Quantifying Software Reliability (Continued) 

In order to describe these software models, some terms need to be 
defined. A failure Is defined as the condition where software 
does not meet Its requirements. A fault Is a specific defect In 
the software that, under certain circumstances, will cause a 
failure. Time to Failure (TTF) , Mean-TIme-To-Fallure (MTTF), Rate 
of Occurrence of Failure (ROCOF), and failure Intensity, (number 
of fallures/unlt time) are terms used to describe software 
reliability. 


The following Is an overview of models used In software 
reliability analysis: 


A. Fault Manifestation Models 

1. The product change statistical model (Currlt, et al) 
calculates the MTTF as a product of the fractional 
Improvement, from each change, of the MTTF raised to the 
power of the number of changes Introduced and the 
estimated Initial MTTF. 

2 . Deterministic Exponential Order Statistical (DET/EOS) 
models, used for a uniform failure manifestation rate and 
a fixed unknown number of failures. Include the 

Jel 1 nskl-Moranda model. The DET/EOS model calculates a 
likelihood function for TTF data as a probability density 
function of observed time to next failures. 

3. Doubly-Stochastlc Exponential Order Statistical (DS/EOS) 
Models . 

a. Independent Identically Distributed Order 
Statistic ( IIDOS) models, used for a manifestation 
rate derived from order statistics from a probability 
distribution function and a finite unknown number of 
faults. Include the Llttlewood Stochastic Reliability 
Growth Model. This model uses a gamma distribution 
for the Individual fault manifestation rates to 
calculate the ROCOF. 

b. Non-Homogeneous Poisson Process (NHPP) models, used 
for a manifestation rate derived from an NHPP and an 
Infinite number of faults or a Poisson distributed 
number of faults, Include the generalized 

gamma DS/EOS Model. 

c. Distribution-free model (Glammo) calculates the 
manifestation rate using all possible distributions 
bounded by the data. 
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6. 4. 3.1 Quantifying Software Reliability (Continued) 

B. Interfallure Time Models 

1. The basic execution time model calculates the failure 
Intensity for relatively uniform operational profiles 
using the Initial failure Intensity at the start of 
execution, the average number of failures experienced at 
a given point In time, and the total number of failures 
over all time as parameters. 

2. The Llttleton-Verral 1 Model calculates the R0C0F based on 
the shape parameter of a gamma distribution, and a family 
of scale parameters for that distribution. 

3. The logarithmic Poisson execution time model 

(Musa and Okumoto) defines the failure Intensity as a 
function of the Initial failure Intensity multiplied by 
the exponential function of the product of the average 
number of failures experienced at a given point In time 
and a failure Intensity decay factor. This failure 
Intensity decay factor Is the magnitude of the 
derivative of the natural log of the failure Intensity 
with respect to the average number of failures 
experienced. Musa demonstrates that this model Is useful 
for highly nonuniform operation profiles. 

6. 4. 3. 2 Relating Software Reliability to Software Verification Techniques 

An area of required technology development will be to Investigate 
the feasibility of using parametric modeling techniques (analysis 
of various software verification techniques and correlation to 
historical reliability data) to develop a model that will predict 
reliability as a function of the software development process. 

6.5 Flight Test 

Flight test Is the ultimate stage In the verification of design 
process. It Is the final proof of concept activity for any new 
aircraft system approach and Is an Indispensable step In such 
situations. All other stages of design verification (laboratory 
simulation and Iron bird studies) can only be approximate models 
of the full up operational aircraft (see Section 7 for the 
description of the Flight Test Program). However, flight test Is 
limited. It cannot examine every flight control system state. 

6.6 Direct FAA/FBL Program Participation 

The lack of established mature U.S. certification basis and 
procedures for FBW/FBL stands as an Impediment to 
U.S. Introduction of advanced technology commercial transport 
aircraft Into the world marketplace. This program, which Includes 
participation of the FAA, NASA, DoD, and several major aircraft 
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6.6 


Direct FAA/FBL Program Participation (Continued) 

manufacturers. Is defining the development path for advanced 
technology certification criteria which are critical to the 
U.S. manufacturers competitive posture with foreign manufacturers. 

Currently digital systems Immune to soft faults, tolerant to 
EM environment upset, and demonstrating MTBF exceeding the life of 
the airframe structure and without backup are being proposed for 
design, yet the existing certification methods and criteria have 
not addressed Issues particular to the complexity of these 
systems. In light of this, over the past one and a half (1-1/2) 
years, DAC/HI has had many discussions with FAA personnel relative 
to a certification basis for FBW/FBL systems. 

Most recent discussions have centered specifically on how 
FAA specialists would directly participate In this FBL Program. 
These discussions are continuing at the detail stage with and 
within the FAA. Current FAA plans call for direct participation 
by the following organizations: 

A. Los Angeles Aircraft Certification Office 

B. Seattle Aircraft Certification Office 


C. Transport Standards Office 

D. FAA Technical Center via an Inter-agency agreement with 
NASA- Langley (current In place) 

FAA direct Involvement Is perceived to be of major Importance. 
Without established procedures, certification risks, financial, 
schedule, and technical cannot be accurately quantified. 


During the last half of 1989, the role of the FAA should be 
clarified. Further, It Is anticipated that the FBL Program will 
heavily Influence the content of a new certification "Advisory 
Circular" (AC) on the subject of FBW/FBL. Related workshops are 
also anticipated. 
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7.0 FLIGHT TEST 


7.1 


7.2 


7.2.1 


7.2.2 


Background 

Douglas Aircraft Company and Honeywell, Inc. ( DAC {HI) are 
currently Involved in developing and verlf ylng/val Idatlng 
flv-by-wl re/fly-by- light (FBW/FBL) concepts for application to 
future transport aircraft. First delivery from HI to DAC of a set 
of FBW units occurred In June, 1989. Upgrades are scheduled for 
the next two years during which numerous technical Issues must be 

resolved . 

Del Iverables/Characterlstlcs of Flight Control Computer System 

To facilitate Verification and Validation (V8.V) aspects of the 
FBL program Including flight test. DAC/HI suggest that they 
supply one (option for two) set(s) of FBW/FBL flight control 
computers to NASA. Early program results will directly Influence 
the capabilities built Into these units. 

At the same time, DAC/HI suggests that they supply a fixed-base 
test facility capable of full-fidelity on-ground verification of 
the FBW/FBL flight control computers prior to flight test. This 
would be Integral to an "Iron bird" facility. The simulation 
quality would be adequate to validate aircraft handling and 
performance requirements. This facility would be J' e ^ de |J t . f !, e 
Langley flight test facility and be the property of the National 
Aeronautics and Space Agency (NASA). 

Flight Control Computer Physical Characteristics 

The proposed basic flight equipment consists of ,£ 0U m m.! 9 lUh frhp 
control computers which are line replaceable units (LRU) with the 

following characteristics: 

A. 41.2 lbs. per flight control computer 

B. 128 watts per flight control computer 

C. 10 MCU ARINC 600 chasls 

During the course of the program certain techniques will be 
evaluated and those with a high degree of merit and feasibility 
will be Incorporated Into the flight control computers. These 
techniques may be associated with the following areas of 
Investigation: Electromagnetic effect (EME) hardening, transient 

fault protection, extended availability through secondary 
redundance, etc. 


Flight Control Computer System Deliverables 

Deliverables associated with the program Include the following: 

A. Four flight control computers (one ship set) and one spare 
flight control computer 
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Flight Control Computer System Deliverables (Continued) 

B. One (1) closed-loop validation facility 

C. System Specification Document 

D. Software Requirements Document 

E. Flight control computer hardware/software updates as required 

On-site support will be provided continuously from Initial 
delivery until program completion. The type and magnitude of 
on-site support will be as dictated by program needs. 

Basic Flight Control Computer Architecture/Design Overview 


7.3.1 


7.3.2 


7.3.3 


Basic Architecture 

The basic aircraft configuration consists of four flight control 
computers which are dual-lane fall-passive, configured to provide 
a f al 1 -operatl onal Primary Flight Control ( PF C ) System. These 
four flight control computers provide system generic fault 
protection through three- version techniques. The basic redundancy 
management architecture was originally developed as a 
Honeywell, Inc. (HI) IR&D Project for application to FBW systems. 
This architecture Is now being adapted to the MD-11 flight control 
computer/LSAS currently In development. 

Generic Fault Protection 

This system has been In development at HI for eight years. 
N~vers1on techniques have been developed and refined during the 
737-300 and MD-11 systems developments as well as through 
continuing research and development efforts. Including Joint 
research programs with University of California, Los Angeles 
(UCLA). Currently, the base MD-11 equipment with modifications 
made for a completely digital FBW system with ARINC 629 
bidirectional bussing Is being evaluated at DAC In their FBW/TdL 
R&D Program. 

Flexible Input/Output Interface Capability 

The flight control computer architecture was designed specifically 
to allow for substantial Input/Output (I/O) signal composition 
changes with minimal to no changes to the hardware. Generic I/O 
card connector Interfaces allow addltlons/subtractlons/swaps of 
I/O card types to Increase or decrease the quantity of a given 
signal type easily. 

This flexibility will be used to match the flight control 
computers to the other avionic subsystems onboard the flight test 
aircraft, as necessary thus reducing the risk of an Interface 
mismatch and subsequent schedule delay. 
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7.3.4 Partitioning of Software by Criticality 

The flight control computer Includes the capability to partition 
(relative to fault effects) sections of the overall software 
package that execute concurrently on a single processor. The 
mechanism for achieving software-fault-effects partitioning Is 
being used on the DAC MD-11 aircraft program and, as such, will 
have a certification precedent. For most commercial digital 
avionics systems, the entire software package associated with a 
specific processor must be certified to the criticality of the 
most critical software element. The problem this presents 
relative to Integration Is obvious. 

To facilitate partitioning, HI has developed a specialized 
Integrated circuit. The specific methodology Is patented. 

7.3.5 Electronic Design Practices 

The electronic design rules adopted for the flight control 
computer resulted from the experience gained through previous 
digital LRU production programs at HI. This previous experience 
has demonstrated the Importance of many design precepts, Including 
the following: 

A. Distinct electronic separation of the two lanes that make up 
the dual flight control computer. 

B. Design guidelines that maximize Immunity to noise and external 
Electromagnetic (EM) disturbances. Standardization of 
parallel digital data bus and I/O Interface protocols. 

C. Design guidelines that provide effective Built-in-Test (BIT) 
for fault detection and Isolation. 

The design approach used for the flight control computer Is that 
of clear and distinct separation of redundant elements. This 
results In easily understood and highly visible hardware 
partitioning, Including separate processors, memories, power 
supplies, and I/O conversion. 

Multilayer circuit boards and motherboards provide high Integrity 
ground and power systems within the flight control computers. 

Logic clocking signals required between circuit boards are 
transmitted differentially and are the only edge sensitive signals 
communicated between circuit boards. 

7.4 Closed-Loop Validation Facility Overview 

7.4.1 Rationale for Closed-Loop Validation Facility 

In order to test and verify the FBL/PFC system a sophisticated 
closed-loop validation facility will be required to provide the 
capability of both a high fidelity dynamic aircraft environment 
simulation and a static simulation for flight control computer 
validation. 
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A Typical VALFAC System Configuration 


FIGURE 7.4-1 

A Typical VALFAC System Configuration 
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7.4.1 


7.4.2 


Rationale for Closed-Loop Validation Facility (Continued) 


This facility will augment the empirical portion of the V&V 
process of the FCS, providing a means of testing and validating 
the system prior to actual flight test. The facility Is essential 
for the flight test phase of the program for providing a means of 
verifying any and all changes made to the flight control computers 
before succeeding flights. A typical VALFAC system configuration 
Is shown In Figure 7.4-1 . 


It will be used to simulate real-time aircraft and engine 
dynamics, air data, navigation, and autofllght system as wel as 
to provide a pilot Interface and a Closed-Loop Validation Facility 
operator's Interface. It will provide all electrical and opt cal 
Interfaces to the flight control computers and have the capability 
of Injecting faults onto the electrical and optical Interfaces for 
testing the control system responses to different failures. 


The Closed-Loop Validation Facility could also be used during 
EME environment testing using an Iron bird mock-up of the 
FBL system for providing monitoring capability of the system and 
actuator buses of the flight control system. 


Simulation Capabl llty/Descrlptlon 

The fundamental purpose of the validation facility Is two-fold as 

outlined below. 

A. To support the testing and validation of the FBL Integrated 
system by providing simulations for the needed 
functions/subsystems, and to provide a means of validating the 
entire Integrated system, Including all Incremental changes, 
prior to each test flight. 

B. To support the testing and validation of the F BL/f light 
control computer suite during Its development and after 
Incremental changes by providing a simulation of Its entire 
envl ronment . 

In order to accomplish the above, the validation facility will 

provide the following: 

A. Aerodynamic and engine simulations. 

B. Simulation of all avionics Interfacing to the flight control 
computer suite. 

1. Inertial reference system 

2. Rate gyro system 

3. Air data system 

4. Auto flight system 

5. etc. 
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7.4.2 Simulation Capablllty/Descrlptlon (Continued) 

C. Simulation controls. 

1 . Pilot Inputs 

2. Dynamic testing mode 

3. Static testing mode 

The following sections describe the above requirements. 


7. 4. 2.1 


Aerodynamic Simulation 

The computational capability of the computer system used for the 
aerodynamic simulation will be sufficient to simulate the dynamics 
of aircraft motion to the extent necessary to realistically 
simulate flight of the aircraft throughout Its operating envelope 
as It would be seen by the flight control computer suite. 


A realistic aerodynamic simulation will require the following: 

A. A full s 1 x-degree-of-f reedom aerodynamic model with an update 
rate fast enough to generate all aircraft characteristics of 
concern. 

B. Experiment data from the test aircraft to model the aircraft 
engines and aerodynamic effects due to all surface deflections 


7. 4. 2. 2 Avionics Simulations 

In addition to the flight control aerodynamic simulation, the 
validation facility must also provide a simulation for all the 
avionics systems that Interface with the flight control 
computers. The below paragraphs give a brief description of the 
main systems that will be simulated. 

A Inertial Reference System (IRS): This simulation outputs the 

necessary set of IRS data as required by the overall 
simulation. Coordinate transformations must be made as 
necessary to determine accelerations, velocities, attitude, 
and position relative to the earth's coordinate system. In 
some cases, the IRS data will need to be computed In double 
precision to achieve the accuracy necessary for long distance 
navigation. The effects of simulated winds must be Included 
In the calculation of velocities and positions. Multiple 
outputs will need to be provided to simulate multiple IRSs. 
Each output will need the capability of being separately 
manipulated for the simulation of errors such as drift, noise 
and relative time skew. 

B. Air Data Computer (ADC): This simulation calculates the 

airspeeds, pressures, temperatures, and altitude of the 
aircraft. These computations must be based upon the 
definition of the International standard atmosphere. The 
model should have the capability of accepting barometric 
corrections as needed. 
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7. 4. 2. 2 Avionics Simulations (Continued) 

C. Thrust Management Computer (TMC): This simulation Prides 

the necessary automatic throttle control to couple with the 
flight control computer. The appropriate thrust commands are 
computed by this model for use by the engine model according 
to mode and command Information received from the autofllght 
system model . 

D Autofllght System (AFS): This simulation provides the 

autofllght functions of the validation facility. When 
engaged, this simulation drives the flight control computers 
as well as the TMC simulation. 


7. 4. 2. 3 Avionics Interfaces 

The specifications for the Interfaces between the flight control 
computer suite and the other aircraft avionics will be define 
according to the configuration of the test aircraft. These 
Interface specifications will describe exactly how the flight 
control computer suite will Interface with each of the other 
avionic systems by describing bus type, bus electrical 
characteristics, and the bus data formats and update rates. 

The validation facility will emulate the avionic Interfaces as 
detailed In the above mentioned specifications accurately so as to 
validate compatibility between the flight control computer suite 
and the test aircraft avionics as development proceeds. 

7. 4. 2. 4 Simulation Controls 

The following sections describe the various means by which the 
operation of the Validation Facility may be controlled. 

7. 4. 2. 4.1 Pilot Station 

The pilot station will provide the full Instrumentation necessary 
to accurately assess the functionality of the flight control 
computers. Simulated or actual flight Instruments, plasma panels, 
CRT's, and other types of displays may be used for generating 
visual outputs. Flight control panels and radio management panels 
are typically Installed In this workstation to allow for user 
selection of aircraft flight modes and annunciations as well as 
radio frequencies. Engine and aircraft Information Is also 
provided at the pilot station. Active pilot station control 
Inputs should Include the following: 

A. Sldestlcks 


B. Speedbrake 

C. Rudder controls 


D. Throttle 


4786S 


7-7 



Fly-By-Light 

Technology Development Plan 


7. 4. 2. 4.1 Pilot Station (Continued) 

E. Flap/slat controls 

F. Mode control panel 

G. Pitch-trim controls 

An alternative to supplying the above cockpit controls would be to 
Interface the validation facility directly to the test aircraft, 
using the cockpit controls of the test aircraft to drive the 
facility. Although this may prove to be a difficult task, the 
potential benefits may warrant further Investigation. 

7. 4. 2. 4. 2 Facility Operator Station 

The Facility Operator Station will consist of the following 
equipment: 

A. Simulation status displays 

B. Control development terminals 

C. Strip chart recorders for real-time data recording 

D. Printers for outputting non-real-time data 

Between the operator station and the pilot station, control of the 
facility will be maximized. 

The operator station will provide the means to monitor the status 
of the simulations as well as to enter special modes of 
operation. The two main modes of operation are dynamic test mode 
and static test mode as outlined In the following two sections. 

A. Dynamic Test Mode 

The validation facility will support a dynamic test mode that 
can be Initiated through the operator station. During dynamic 
mode testing, the aerodynamic model Is enabled. During 
operation In the dynamic mode, the operator will have the 
capability to perform any of the following functions. 

1. Fly the simulated aircraft to perform tests on the 
Integrated FBL system. 

2. Record outputs from both the simulation of the flight 
control computer suite. 

3. Insert error offsets noise or wind Into sensor output. 

4. etc. 
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7. 4. 2. 4. 2 Facility Operator Station (Continued) 

The operator station will allow either Initialization of or 
Intervention Into the simulation during dynamic test mode 
operation. During Initialization, the capability of selecting 
either default Initial conditions or entering new Initial 
conditions prior to trimming the aircraft will be provided. 

Some additional functions may be added as the Integration 
validation facility will be used to support EME environment 
testing of the FBL system on the Iron bird. 

B. Static Test Mode 

The validation facility will also support a static test mode 
that can be Initiated through the operator station. During 
static test mode operation, the aerodynamic simulation Is 
disabled. The only functions supported In this mode are the 
following: 

1. I/O to the flight control computer suite. 

2 Modification of the data being transmitted to the flight 
control computers Including any error code fields. 

3. Examination of data being received from the flight 
control computers. 

4. Strip chart and printer setup for recording test results. 

The static test mode Is more flexible In a development 
environment than the dynamic mode In that each variable output 
to the flight control computers Is Individually controllable. 

7. 4. 2. 5 Maintainability 

It Is Important to keep the closed-loop validation facility fully 
functional during all phases of program development. Measures 
must be taken to ensure a high degree of Integrity and 
maintainability of the facility. The system should have the 
following characteristics. 

A. All I/O and control cards should be based on proven designs. 
Spares must be available for Immediate replacement should the 

need arise. 

B Additional computer processor and control cards must be stored 
as spares should a subsequent replacement be necessary. 

C. Built-In Test (BIT) features should be Included In the 
design. Computer diagnostics and any other simulator hardware 
should have test programs that are capable of detecting faults 
to the card level . 

D. A software backup system must be provided. 
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7. 4. 2. 5 Maintainability (Continued) 

E. Preventive and corrective maintenance must be provided 
according to maintenance agreement. 

F All documentation must accurately depict the configuration of 
the system, and all software and hardware shall be maintained 
under configuration control. 

7. 4. 2. 6 Documentation and Configuration Control 

The closed-loop validation facility designs and Implementation 
methodologies will be documented In detail. A full definition of 
the facility as a system will be generated. Each subsystem and 
hardware function will be thoroughly described. Schematics, 
wire lists, assembly drawings, and other written documentation 
will be maintained. Overall software development will follow 
DO-178 Guidelines. Software functions will be designed using 
structured techniques. Detailed source language listings will 
also be generated. Software and documentation will be archived on 
computer readable media. 

7. 4. 2. 7 Certification 

The closed-loop validation facility will be designed, built, 
Inspected, and tested to levels required by the Federal Aviation 
Administration ( FAA) and NASA. Certification of the closed-loop 
validation facility will not be required, but the three basic 
steps of conformity, acceptance test, and system test will be 
taken. 

7.5 Flight Test Issues 

7.5.1 General Flight Test Issues 

7. 5. 1.1 Handling Qualities and Crew Workload Evaluation 

Flight test Is used to evaluate both the handling qualities of the 
aircraft and crew workload during different flight regimes. The 
evaluation typically takes Into account the ergonomics of the 
cockpit and the responsiveness of the control system to pilot 
Inputs In the maneuvering of the aircraft. 

For the fly-by-llght aircraft flight test, the focus will be on 
the response of the system rather than the ergonomics of the 
cockpit since the purpose of flight test Is to prove the concept 
of the FBW/FBL system. 
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7. 5. 1.2 Vehicle Aerodynamic Evaluation 

Flight test Is also typically used to evaluate the aerodynamics of 
the test aircraft. Since the test aircraft Is of a proven 
aerodynamic design, this particular part of the evaluation will be 
focused on the testing and evaluation of the control law software 
that has been programmed Into the flight control computers. This 
evaluation will determine If the flight control system adequately 
responds according to the established performance criteria set for 
the aircraft type. 

7. 5. 1.3 Shock/Vibration and Other Operational Problems 

This Is crucial part of the flight test evaluation for the 
avionics equipment to ascertain any observable operational 
problems, such as shock and vibration effects on the system 
components or any other mechanical type problems. 

7.5.2 Flight Test Issues Specific to Fly-By-Light Aircraft 

7. 5. 2.1 Proof of Concept 

Flight test Is critical for the evaluation of the fully Integrated 
FBW/FBL system. Variation Induced by actual flight will deviate 
from the simulation slightly. Therefore, the flight test provides 
the confidence In the control system that It perform safely and 
functions correctly In the actual circumstances It was Intended to 
operate In. 

7. 5. 2. 2 Shock/Vibration and Environmental Evaluation of Fiber Optic 
Connectors 

An Important aspect to the FBW/FBL flight test Is the actual 
vibration effects on fiber optic connectors known as 
Vlbro-Mechanlcal Interference (VMI). In order to adequately 
access If VMI Is a problem, the fiber optics must experience long 
term vibration and environmental aging. This will require many 
flight hours to be logged with the FBW/FBL system. 

Also another concern for fiber optics Is the exposure to the harsh 
environment of the aircraft. Such as the different temperature 
extremes, other mechanical stresses, and the contaminants 
(hydraulic fluid, etc.) present In the fuselage of the aircraft. 
Flight test will help assess these potential problems. 

7. 5. 2. 3 Evaluation of Fiber Optic EME Protection Effectiveness 

This part of the flight test evaluation should help answer the 
following questions: 

A. Does fiber optics provide sufficient protection against the 
EME threat? 

B. What Is the protection effectiveness level that fiber optics 
provide to the system? 
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8.0 RECOMMENDATIONS 

A. Establish a national resource for system modeling to Include 
redundancy management. 

B. Establish a national resource for electromagnetic effect (EME) 
assessments/analytical predictions . 

C. Establish a national resource for EME full threat testing 
capability. 

D. Survey and document Industry experience with the application 
of N-verslon techniques. 

E. Based upon experience gained In both Industrial applications 
and research experiments, one or more development 
methodologies for N-verslon techniques should be documented. 

It Is believed essential that formal mature methodologies be 
clearly established. 

F. Flight test validation via flight test of FBW/FBL flight 
control system. 

G. Optical data transmission validation. 

H. Optical sensor development, post first generation fly— by— light. 

I. Evaluation of life cycle maintenance of FBL (extended 
aval labl 1 1 ty ) . 

J. Validation of transient tolerant architectures, (system 
recovery techniques). 

K. Extension of software methodologles/valldatlon appropriate for 
full-time flight-critical commercial transport avionics 
systems . 
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9.0 OVERVIEW OF FLY-BY-LIGHT TECHNOLOGY DEVELOPMENT PLAN 

9.1 Outline of Phases (reference Table 9.0-1) 

A. Phase I: Fly-By-Light ( FBL) Architecture Development 

B. Phase II: Verification and Validation (V&V) of FBL 

C. Phase III: Integration of a FBL System 

D. Phase IV: Flight Test of a FBL System 

9.1.1 Description of Phases 

9. 1.1.1 Phase I: Fly-By-Light Architecture Development 

This phase encompasses the definition and design of representative 
new technology subsystems, their validation and Integration as 
needed for a first generation FBL/f light control system which 
Incorporates an optimized blend of electronic and optical 
technologies; and the development, prototyping, acquisition, and 
testing of new technologies, hardware, and subsystems that make up 
the FBL system. 

9. 1.1. 2 Phase II: Verification and Validation of Fly-By-Light 

This phase encompasses the establishment of the criteria and 
approach for the certification of a FBL/fllght control system; the 
development of design/optimization tools; V&V tools for fault 
tolerant operation at the subsystem and system levels; the 
development of electromagnetic (EM) propagation models to predict 
coupling levels, and effects through the aircraft and Its systems; 
and document proof of relevant correlation between the models and 
"real" systems via an extensive hardware test and analysis program 

A major goal of this phase Is to develop and demonstrate the use 
of tools for certification purposes by performing V&V via models 
rather than exhaustive and expensive physical testing of hardware 
and software. In association with this program the Federal 
Aviation Administration (FAA) will directly participate In 
deriving a FBL certification basis. 

9. 1.1. 3 Phase III: Integration of a Fly-By-Light System 

This phase encompasses the bench test plan development; the design 
and construction of a FBL "Iron bird" Integration and test 
facility; the Installation and Integration of FBL system; and the 
hot bench testing of the FBL/fllght control system. 
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9. 1.1. 4 Phase IV: Flight Test of a Fly-By-Light System 

This phase encompasses the development of the flight test aircraft 
Installation designs and the flight test plan; the aircraft 
modification; the aircraft Installation of the FBL/fllght control 
system, and the flight test. 

9.2 Major Aspects 


9.2.1 Phase I: Fly-By-Light Architecture Development (30M) 

A. Identify/define methodologies with potential 

application on next generation aircraft. (1M) 

B. Contrast methodologies to provide subsystem 
extended availability; l.e., effective 
mean-tlme-between-fal 1 ure (MTBF) equal to or 

greater than 100,000 hours. (2M) 

C. Contrast methodologies for subsystem fault tolerance. (2M) 


1 . Hard faults . 

2. Soft faults. 

3. Generic faults. 

D. Contrast potential next generation sensor methodologies. (3M) 

1. Power-by-1 Ight. 

2. Passive optical . 

3. Traditional sensors. 

E. Contrast next generation actuation technology. (2M) 


1 . 

Smart 

versus simple. 

2. 

Fault 

protection . 

3. 

Interface. 


F. Determine optimum data sharing/transmission 

methodologies. ( 5M ) 

1. Optical. 

2. Electrical. 

3. Hybrid. 

G. Develop viable fly-by-llght Integrated architectures 

for near and long term applications. (15M) 
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9.2.2 Phase II: Verification and Validation of Fly-By-Light (46M) 

9. 2. 2.1 Electromagnetic Effect (EME) Verification and 

Validation (V&V). ( 30M > 

A. Develop a national resource for analytical 

prediction of EMEs. (17M) 

1. On surface of aircraft. 

2. Inside structure. 

3. On cables. 

4. Within line replaceable units (LRUs). 

5. Within card assemblies. 

6. Within electronic devices. 

7. Predict results of EME tests/test configurations. 


B. 

Develop technology necessary for limited full threat 
EME testing of aircraft and associated subsystems. 

(8M) 

C. 

Validate EME prediction resource. 

(5M) 

9. 2. 2. 2 Fault Tolerance V&V 

(16M) 

A. 

Evaluate available means for modeling fault effects 
(e.g., Semi-Markov Unreliability Range Evaluator 
[SURE], CARE III, Hybrid Automated Reliability 
Predictor [HARP]). 

(1M) 

B. 

Define capabilities required to fully validate fault 
handling capablllty/characterlstlcs. 

(1M) 


1. Functional modeling. 



2. Circuit modeling. 



3. NAND-gate-equI valent modeling. 


C. 

Develop/enhance analytic modeling tools to provide 
needed capabilities through the year 2005. 

(8M) 

D. 

Validate modeling/analysis tools. 

(6M) 

9. 2. 2. 3 FAA 

Participation 


A. 

Integral FAA Involvement will provide for development 
of cost-effective certification procedures for 
f ly-by-wlre/f ly-by-llght ( FBW/FBL) aircraft built 
In the USA. 
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9.2.3 Phase III: Integration of a Fly-By-Light System (65M) 

A. Build new flight hardware. (40M) 

B. Develop "Iron bird" Integratlon/val Idatlon facility. (25M) 

1. Simulator. 

2. Subsystem/component Installation. 

3. Evaluation testing. 

4. Aircraft modeling. 

5. Subsystem/component test facilities. 

9.2.4 Phase IV: Flight Test of a Fly-By-Light System (31M) 

A. Aircraft modification to accept new subsystems. (9M) 

B. Deslgn/bulld/lnstal latlon of In-flight data gathering 

facilities for each major subsystem to be evaluated. (6M) 

C. Subsystem/component Installation. (7M) 

D. Ground check test. (2M) 

E. Test plans. 

F. Test flights. ( 6M ) 

This plan Includes $1 72M total Industry and government 
funding. 


4787S 


9-4 


Fly-By-Light 

Technology Development Plan 


FINAL REPORT 
30 August 1990 


FLY - BY - LIGHT TECHNOLOGY DEVELOPMENT PLAN 



FY 91 FY 92 FY 93 FY 94 FY 95 FY96 


TABLE 

9 . 0-1 

9-5 


4787S 




TECHNOLOGY DEVELOPMENT PLAN 







Fly-By-Light 

Technology Development Plan 


FINAL REPORT 
30 August 1990 


10.0 BIBLIOGRAPHY 

R. F. Hess, L. J. Yount, H. Knoller, G. M. Hasson, and 
W. E. Larsen, "Sharing the Protection of Aircraft Electronic 
Systems Against the Effects of High-Level Electromagnetic 
Environments Between Traditional Protection and System 
Architecture," AIAA/IEEE 8th Digital Avionics Systems Conference 
(October 1988). 

R. F. Hess, "Implications Associated with the Operation of Digital 
Data Processing In the Presence of the Relatively Harsh 
EMP Environments Produced by Lightning," International Aerospace 
and Ground Conference on Lightning and Static Electricity 
(June 1985) . 

"Recommended Draft Advisory Circular-Protection of Aircraft 
Electrical/Electronic Systems Against the Indirect Effects of 
Lightning," SAE AE4L Committee Report: AE4L-87-3. 

"Test Waveforms and Techniques for Assessing the Effects of 
Lightning Induced Transients," SAE AE4L Committee Report: 

AE4L-81 -2 . 

R. F. Hess, "Properties of Induced Transients Associated with 
EH Fields Produced by Lightning or Other Relatively Slow Rise Time 
EHP," IEEE Proc. 1978 International Symposium on EHC. 

R. F. Hess, "EHP Coupling Analysis Using the Frequency (Transfer 
Function) Hethod with the Sceptre Computer Program," August 1975 
IEEE Transactions on EHC. 

J. R. Todd, "The Role of Fiber Optics on Commercial Aircraft," 
Society of Photo-Optical Instrumentation Engineers Symposium on 
Fiber Optics and Opto-electronlcs , August 10-21, 1987. 

J. R. Todd, "Toward Fly-By-Light Aircraft," Society of 
Photo-Optical Instrumentation Engineers, September 6-9, 1988. 

J. R. Todd, "Development of Fly-By-Light Systems," Society of 
Photo-Optical Instrumentation Engineers Symposium on 
Opto-Electronlcs and Fiber Optic Devices and Applications, 
September 5-8, 1989. 

A Case of Submicrosecond Rise Time Lightning Current Pulses for 
use In Aircraft Induced Coupling Studies: Hartln A. Uman, 

University of Florida, Gainesville, F L ; Don W. Clifford, HcDonnell 
Aircraft Company, St. Louis, HO; and E. Phillip Krlder, University 
of Arizona, Tucson, AZ. 1979 International IEEE Symposium on EHC, 
San Diego, California (October 9, 1979). 


10-1 


4787S 


Fly-By-Light 

Technology Development Plan 


FINAL REPORT 
30 August 1990 


10.0 BIBLIOGRAPHY (Continued) 

Evaluation of Lightning-Induced Transients In Aircraft Using 
High-Voltage Shock Excitation Techniques: D. W. Clifford/ 

K. S. Zelsel , McDonnell Aircraft Company, St. Louis, MO. 1979 
International IEEE Symposium on EMC, San Diego, California 
(October 1979) . 

D. W. Clifford, "The Impact of the Total Lightning Environment on 
Aircraft Flight Control Systems," Proceedings of the 1978 
International IEEE Symposium on EMC, Atlanta, Georgia (June 1978). 

Pitts, Felix L., George B. Flnelll, Rodney A. Perala, and 
Terence H. Rudolph, "F-106 Data Summary and Model Results Relative 
to Threat Criteria and Protection Design Analysis," In 1986 
International Aerospace and Ground Conference on Lightning and 
Static Electricity, AFWAL-TR-86-3098, U. S. Air Force, 

October 1986. 

Felix L. Pitts, "Electromagnetic Measurement of Lightning Strikes 
to Aircraft," presented at AIAA 19th Aerospace Sciences Meeting, 
St. Louis, MO, January 12-15, 1981. 

F. L. Pitts, et al., "In-Flight Lightning Characteristics 
Measurements System," Federal Aviation Administration - Florida 
Institute of Technology Workshop on Grounding and Lightning 
Technology, FAA-RD-79-6, March 1979, pp. 105-111. 

C. A. Clarke, W. W. Larsen, "Aircraft Electromagnetic 
Compatibility," D0T/FAA/CT-86/40, June 1987. 

C. R. Spltzer, Digital Avionics Systems , Prentice Hall, 

Englewood Cliffs, New Jersey, 1987 


10-2 


4787S 


NASA 

Nato U I Alio uulCS ATO 


1. Report No. 

NASA CR- 181954 


4. Title and Subtitle 


Report Documentation Page 


2, Government Accession No. 


Fly-by-Light Technology Development Plan 


3. Recipient's Catalog No. 


S. Report Date 

August 1990 


6. Partorming Organization Code 


7. Auihor(s) 

j. R. Todd 


8. Performing Organization Report No. 


9. Performing Organization Name and Address 

McDonnell Douglas Corporation 
Douglas Aircraft Company 
3855 Lakewood Blvd. 

Long Beach, CA 90846 


12. Sponsoring Agency Name and Address 

National Aeronautics and Space Administration 
Langley Research Center 
Hampton, VA 23665-5225 


IS. Supplementary Notes 

Technical Monitor: Cary R. Spitzer 

Final. Report - Task 9 


10. Work Unit No. 

506-46-21-05 


11. Contract or Grant No. 

NAS 1-18028 


13. Type of Report and Period Covered 

Contractor Report 

14. Sponsoring Agency Code 


16. Abstract 


This report describes a national plan to make Fly-by-Light an effective technology 
leap for the U.S. commercial aircraft industry in the late 1990‘s. The driving 
factors and developments which make this technology viable are discussed and 
documentation, analyses, and recommendations needed to facilitate the introduction 
of commercial Fly-by-Light aircraft are provided. To accomplish this goal a 
unified "national" effort, coordinated by NASA, is proposed. 


W-bT-t JSijiQcjested by Author! $)) 

Fly-by-Wire 
Flight Controls 
Fault Tolerance 
Optical Sensors 


19. Security Classif. (of this report] 

Unclassified 


Flectromagnetic 
Interference 
Fiber Optics 


16. Distribution Statement 


(REVIEW FOR GENERAL RELEASE 
2 YEARS FROM PUBLICATION DATE) 

Subject Category 08 


20. Security Classif. (of this page) 

21. No. ol pages 

Unclassified 

182 



NASA HJilM It Uu UC1 oo 



















